CVE-2024-47071: OSS Endpoint Manager allows unauthorized access to read system files

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-01 · updated 2026-06-17
Weakness: CWE-22

Description

OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to read system files with the permissions of the webserver process. This vulnerability is fixed in 14.0.4.

Affected products

FreePBX Endpoint Manager: before 14.0.4 — fixed in 14.0.4

How to fix

Upgrade to a fixed version: FreePBX Endpoint Manager 14.0.4. Check the vendor advisory for mitigations.

References

https://github.com/FreePBX-ContributedModules/endpointman/commit/bad70ca3de2166bbd24f273f7f212a8b2c92a719
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-x9wc-qjrc-j7ww

Get alerted when CVE-2024-47071 or the next vulnerability affects your stack