axon pbx vulnerabilities and fixes

Recent CVEs affecting axon pbx, with upgrade or downgrade steps. 14 tracked.

Also searched as: axonpbx.

axon pbx has 14 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 12. Most recent: 2021-07-25. Highest priority: CVE-2021-37441 (score 54/100).

• CVE-2021-37462 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).
• CVE-2021-37461 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected)
• CVE-2021-37460 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).
• CVE-2021-37459 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).
• CVE-2021-37458 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).
• CVE-2021-37457 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).
• CVE-2021-37456 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).
• CVE-2021-37455 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).
• CVE-2021-37454 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).
• CVE-2021-37453 MEDIUM 5.4 UPGRADE Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).
• CVE-2021-37441 HIGH 8.8 UPGRADE NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.
• CVE-2021-37440 MEDIUM 6.5 UPGRADE NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.
• CVE-2018-11552 MEDIUM 6.1 DOWNGRADE There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field
• CVE-2018-11551 HIGH 7.8 DOWNGRADE AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to e

FAQ

How do I fix axon pbx vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is axon pbx being exploited right now?

None of the tracked axon pbx CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which axon pbx CVE should I patch first?

CVE-2021-37441 currently ranks highest (54/100): NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/..

RSS feed for axon pbx · ← Back to latest CVEs