CVE-2021-37440

Name of the Vulnerable Software and Affected Versions NCH Axon PBX versions 2.22 and earlier

Description The issue allows path traversal for file disclosure via the logprop?file=/.. substring. This enables unauthorized access to files on the system.

Recommendations For NCH Axon PBX versions 2.22 and earlier, consider restricting access to the logprop API endpoint until a patch is available. As a temporary workaround, avoid using the file parameter in the logprop endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.