CVE-2021-45490 - OpenCVE

The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
3cx	3cx

Configuration 1 [-]

OR	cpe:2.3:a:3cx:3cx::::::iphone_os::*
	cpe:2.3:a:3cx:3cx::::::android::*
	cpe:2.3:a:3cx:3cx:::::legacy:windows::

References

Link	Resource
https://packetstormsecurity.com/files/166376/3CX-Client-Missing-TLS-Validation.html	Third Party Advisory VDB Entry
https://www.3cx.com/community/forums/posts-articles-news/	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2022-03-28T01:10:43

Updated: 2022-03-28T01:10:43

Reserved: 2021-12-25T00:00:00

Link: CVE-2021-45490

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-03-28T02:15:06.950

Modified: 2022-04-04T20:36:01.237

Link: CVE-2021-45490

JSON object: View

Redhat Information

No data.

CWE

CWE-295

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:3cx:3cx:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "2C9D3D50-9115-4133-98AD-CBD22F64DF8D", "versionEndIncluding": "18.0.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:3cx:3cx:*:*:*:*:*:android:*:*", "matchCriteriaId": "486A0282-3B86-42BF-BF20-8887CD878D22", "versionEndIncluding": "18.0.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:3cx:3cx:*:*:*:*:legacy:windows:*:*", "matchCriteriaId": "CA0B0398-637E-4B49-AAF3-46672D832F47", "versionEndIncluding": "2022-03-17", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation."}, {"lang": "es", "value": "Las aplicaciones cliente en 3CX en Windows, la aplicaci\u00f3n 3CX para iOS, y la aplicaci\u00f3n 3CX para Android versiones hasta 17-03-2022 carecen de comprobaci\u00f3n de certificado SSL"}], "id": "CVE-2021-45490", "lastModified": "2022-04-04T20:36:01.237", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-03-28T02:15:06.950", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://packetstormsecurity.com/files/166376/3CX-Client-Missing-TLS-Validation.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.3cx.com/community/forums/posts-articles-news/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "nvd@nist.gov", "type": "Primary"}]}