PatchTheCVEtrixbox vulnerabilities and fixes
Recent CVEs affecting trixbox, with upgrade or downgrade steps. 8 tracked.
trixbox has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2020-05-01. Highest priority: CVE-2017-14535 (score 61/100).
- CVE-2020-7351 HIGH 7.3 UPGRADE An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Ed
- CVE-2017-14537 MEDIUM 6.5 DOWNGRADE trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang
- CVE-2017-14536 MEDIUM 5.4 DOWNGRADE trixbox 2.8.0.4 has XSS via the PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php.
- CVE-2017-14535 HIGH 8.8 DOWNGRADE trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home
- CVE-2014-5112 HIGH 7.5 MITIGATE maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via she
- CVE-2014-5111 MEDIUM 5.0 MITIGATE Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary file
- CVE-2014-5110 MEDIUM 4.3 MITIGATE Cross-site scripting (XSS) vulnerability in user/help/html/index.php in Fonality trixbox allows remote attacke
- CVE-2014-5109 HIGH 7.5 MITIGATE SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remot
FAQ
How do I fix trixbox vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is trixbox being exploited right now?
None of the tracked trixbox CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which trixbox CVE should I patch first?
CVE-2017-14535 currently ranks highest (61/100): trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home.