CVE-2014-7235
CRITICAL
10.0
CVSS Severity Score
Vulnerability Description
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as exploited in the wild in September 2014.
Affected Platforms (CPE)
📦
Freepbx
Freepbx
= 2.10.0.0📦
Freepbx
Freepbx
= 2.10.0.1📦
Freepbx
Freepbx
= 2.10.0.2📦
Freepbx
Freepbx
= 2.10.0.3📦
Freepbx
Freepbx
= 2.10.0.4📦
Freepbx
Freepbx
= 2.10.0.5📦
Freepbx
Freepbx
= 2.10.0.6📦
Freepbx
Freepbx
= 2.10.0.7📦
Freepbx
Freepbx
= 2.10.0.8📦
Freepbx
Freepbx
= 2.10.0.9📦
Freepbx
Freepbx
= 2.10.0.10📦
Freepbx
Freepbx
= 2.11.1.0📦
Freepbx
Freepbx
= 2.11.1.1📦
Freepbx
Freepbx
= 2.11.1.2📦
Freepbx
Freepbx
= 2.11.1.3📦
Freepbx
Freepbx
= 2.11.1.4📦
Sangoma
Freepbx
<= 2.9.0.8📦
Sangoma
Freepbx
= 2.11.0.0📦
Sangoma
Freepbx
= 2.11.0.1📦
Sangoma
Freepbx
= 2.11.0.2📦
Sangoma
Freepbx
= 2.11.0.3📦
Sangoma