Description
Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/54262
Various Sources x_refsource_confirm
http://freepbx.org/trac/ticket/3660
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/34772
Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/34857
Scores
EPSS
0.0058
EPSS Percentile
43.6%
Details
CWE
CWE-352
Status
published
Products (12)
freepbx/freepbx
2.4
freepbx/freepbx
2.4.0_beta1
freepbx/freepbx
2.4.0_beta2
freepbx/freepbx
2.4.1
freepbx/freepbx
2.5
freepbx/freepbx
2.5.0_beta1
freepbx/freepbx
2.5.0rc2
freepbx/freepbx
2.5.0rc3
freepbx/freepbx
2.5.1
freepbx/freepbx
2.5.2
... and 2 more
Published
May 28, 2009
Tracked Since
Feb 18, 2026