Description

It is possible to intercept calls made using the VoIP platform because the communication is not encrypted.

Impact

Get call information.

Recommendation

Configure the channel with TLS or SRTP and TLS, or configure a firewall to cipher calls.

Threat

Attacker authenticated from the Internet.

Expected Remediation Time

⌚ 60 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the src.

Base

• Attack vector: N
• Attack complexity: L
• Privileges required: L
• User interaction: N
• Scope: U
• Confidentiality: L
• Integrity: N
• Availability: N

Temporal

• Exploit code maturity: X
• Remediation level: X
• Report confidence: X

Result

• Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
• Score:
• Base: 4.3
• Temporal: 4.3
• Severity:
• Base: Medium
• Temporal: Medium

Score 4.0

Default score using CVSS 4.0. It may change depending on the context of the src.

Base 4.0

• Attack vector: N
• Attack complexity: L
• Attack Requirements: N
• Privileges required: L
• User interaction: N
• Confidentiality (VC): L
• Integrity (VI): N
• Availability (VA): N
• Confidentiality (SC): N
• Integrity (SI): N
• Availability (SA): N

Threat 4.0

• Exploit maturity: X

Result 4.0

• Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
• Score:
• CVSS-BT: 5.3
• Severity:
• CVSS-BT: Medium

Compliant code

Modify resource configuration with tls

                port: 8008
  tls: true
  type: https
  x_forwarded: true
  bind_addresses: ['::1', '127.0.0.1']
  resources:
- names: [client, federation]
      compress: false

            

Non compliant code

Insecure resource configuration (No tls)

                port: 8008
  tls: false
  type: http
  x_forwarded: true
  bind_addresses: ['::1', '127.0.0.1']
  resources:
- names: [client, federation]
      compress: false

            

Requirements

• 181.Transmit data using secure protocols

Fixes

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.