PatchTheCVEpbx vulnerabilities and fixes
Recent CVEs affecting pbx, with upgrade or downgrade steps. 9 tracked.
pbx has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2024-01-29. Highest priority: CVE-2023-37599 (score 59/100).
- CVE-2024-0986 MEDIUM 4.7 DOWNGRADE A vulnerability was found in Issabel PBX 4.0.0
- CVE-2023-37599 HIGH 7.5 DOWNGRADE An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules dir
- CVE-2023-37598 MEDIUM 4.5 DOWNGRADE A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a
- CVE-2023-37597 HIGH 8.1 DOWNGRADE Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a d
- CVE-2023-37596 HIGH 8.1 DOWNGRADE Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a d
- CVE-2023-37191 MEDIUM 4.8 DOWNGRADE A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute
- CVE-2023-37190 MEDIUM 4.8 DOWNGRADE A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute
- CVE-2023-37189 MEDIUM 4.8 DOWNGRADE A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 all
- CVE-2023-34839 MEDIUM 6.8 DOWNGRADE A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to
FAQ
How do I fix pbx vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pbx being exploited right now?
None of the tracked pbx CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pbx CVE should I patch first?
CVE-2023-37599 currently ranks highest (59/100): An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules dir.