What’s Vulnerable › Vulnerabilities

CVE-2023-43336

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-11-02 · updated 2026-07-09
• Weakness: CWE-284

Description

Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101.

Affected products

• Sangoma FreePBX: before 15.0.16; from 16.0.2 before 16.0.17; before 15.0.18; from 16.0.2 before 16.0.40 — fixed in 15.0.16, 15.0.18, 16.0.17, 16.0.40

How to fix

Upgrade to a fixed version: Sangoma FreePBX 15.0.16, 15.0.18, 16.0.17, 16.0.40. Check the vendor advisory for mitigations.

References

• https://medium.com/@janirudransh/security-disclosure-of-vulnerability-cve-2023-23336-4429d416f826
• https://medium.com/%40janirudransh/security-disclosure-of-vulnerability-cve-2023-23336-4429d416f826

Get alerted when CVE-2023-43336 or the next vulnerability affects your stack