CVE-2019-12148

The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability involving special characters in the username field. Upon successful exploitation, a remote unauthenticated user can login into the device's admin web portal without providing any credentials. This affects /var/webconfig/gui/Webconfig.inc.php.

• CWE-88

• http://packetstormsecurity.com/files/154915/Sangoma-SBC-2.3.23-119-GA-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Oct/41Exploit, Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/154915/Sangoma-SBC-2.3.23-119-GA-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Oct/41Exploit, Mailing List, Third Party Advisory

Published

Oct 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1214An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2019-12143A Directory Traversal issue was discovered in SSHServerAPI.d…
• CVE-2019-12144An issue was discovered in SSHServerAPI.dll in Progress ipsw…
• CVE-2019-12145A Directory Traversal issue was discovered in SSHServerAPI.d…
• CVE-2019-12146A Directory Traversal issue was discovered in SSHServerAPI.d…
• CVE-2019-12147The Sangoma Session Border Controller (SBC) 2.3.23-119 GA we…9.8
• CVE-2019-12149SQL injection vulnerability in silverstripe/restfulserver mo…
• CVE-2019-1215An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2019-12150Karamasoft UltimateEditor 1 does not ensure that an uploaded…
• CVE-2019-12153Lack of validation in the HTML parser in RealObjects PDFreac…
• CVE-2019-12154XXE in the XML parser library in RealObjects PDFreactor befo…
• CVE-2019-12155interface_release_resource in hw/display/qxl.c in QEMU 3.1.x…