CVE-2024-8504highCWE-78

CVE-2024-8504: fallo de gravedad alta en VICIdial

VICIdial Authenticated Remote Code Execution

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear VICIdial

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

58Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 8.8epss 76%
de la publicación al armael mismo día
Publicada en NVD10 sept
metasploit10 sept
An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
VICIdial · VICIdial
CVEs relacionadas — VICIdial

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-8503CRITICALVICIdial Unauthenticated SQL InjectionEPSS 79.3%CVE-2022-34876MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.EPSS 3.4%CVE-2022-34877MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.EPSS 3.4%CVE-2022-34878MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.EPSS 3.4%CVE-2022-34879MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php.EPSS 0.5%