{"id":"CVE-2022-48482","published":"2023-05-02T00:00:00Z","modified":"2025-01-30T15:39:04Z","title":"3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read…","vendor":null,"product":null,"tier":"tail","description":{"text":"3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directory traversal. Files may have credentials, full backups, call recordings, and chat logs.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.02194,"percentile":0.82402,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://www.3cx.com/blog/change-log/phone-system-change-log/","tags":[]},{"url":"https://medium.com/%40frycos/pwning-3cx-phone-management-backends-from-the-internet-d0096339dd88","tags":[]}],"priority":{"score":21.7,"factors":[{"name":"EPSS percentile","points":16.48},{"name":"CVSS severity","points":5.25}]},"euvd":{"id":"EUVD-2022-51178","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2022-28005-family-cve-2022-28005","children":[{"from":"CVE-2022-48482","to":"CVE-2022-28005","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2022-48482.","from":"CVE.org","in":"CVE-2022-28005"}]}]}}