CVE-2014-5335
Last modified
CVE-2014-5335 is a vulnerability of currently unknown severity. Multiple cross-site request forgery (CSRF) vulnerabilities in innovaphone PBX 10.00 sr11 and earlier allow remote attackers to hijack the authentication of administrators for requests that modify configurations or user accounts, as demonstrated by (1) changing the administrator password via a crafted request to CMD0/mod_cmd.xml or (2) adding a new SIP user via a crafted request to PBX0/ADMIN/mod_cmd_login.xml.. EPSS estimates a 1.22% chance of exploitation in the next 30 days.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in innovaphone PBX 10.00 sr11 and earlier allow remote attackers to hijack the authentication of administrators for requests that modify configurations or user accounts, as demonstrated by (1) changing the administrator password via a crafted request to CMD0/mod_cmd.xml or (2) adding a new SIP user via a crafted request to PBX0/ADMIN/mod_cmd_login.xml.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Innovaphone | Innovaphone Pbx | <= 10.00 | Sr11 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-5335?
How severe is CVE-2014-5335?
How do I fix CVE-2014-5335?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-5329GIGAPOD file servers (Appliance model and Software model) pr…7.5
- CVE-2014-5330Cross-site scripting (XSS) vulnerability in BirdBlog allows …
- CVE-2014-5331Cross-site scripting (XSS) vulnerability in Aflax allows rem…
- CVE-2014-5332Race condition in NVMap in NVIDIA Tegra Linux Kernel 3.10 al…
- CVE-2014-5333Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.…
- CVE-2014-5334FreeNAS before 9.3-M3 has a blank admin password, which allo…
- CVE-2014-5336Monkey HTTP Server before 1.5.3, when the File Descriptor Ta…
- CVE-2014-5337The WordPress Mobile Pack plugin before 2.0.2 for WordPress …
- CVE-2014-5338Multiple cross-site scripting (XSS) vulnerabilities in the m…
- CVE-2014-5339Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allows remo…
- CVE-2014-5340The wato component in Check_MK before 1.2.4p4 and 1.2.5 befo…
- CVE-2014-5341The SFTP external storage driver (files_external) in ownClou…
Are you affected by CVE-2014-5335?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST