CVE-2024-47071

OSS Endpoint Manager allows unauthorized access to read system files

State: Published
Severity: 6.8 Medium
Published: Oct 1, 2024
Updated: Feb 13, 2026
Reserved: Sep 17, 2024

Description

OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to read system files with the permissions of the webserver process. This vulnerability is fixed in 14.0.4.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
endpointmanFreePBX	< 14.0.4Affected

References

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-x9wc-qjrc-j7ww
https://github.com/FreePBX-ContributedModules/endpointman/commit/bad70ca3de2166bbd24f273f7f212a8b2c92a719

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.