Under Review CVE-2023-4863

[Christophm]

Hello,


I just wanted to report that 3CXDesktopApp.exe might be vulnerable to
CVE-2023-4863

I’ve checked the latest version, as well as an older one:

3CX Desktop App Version:18.10.461.
$ strings 3CXDesktopApp.exe |grep '^Chrome/[0-9.]* Electron/[0-9]'
Chrome/102.0.5005.148 Electron/19.0.8

And the latest version:
3CXDesktopApp/app-18.13.959$ strings 3CXDesktopApp.exe |grep '^Chrome/[0-9.]* Electron/[0-9]'
Chrome/112.0.5615.165 Electron/24.3.0

Please let me know if and when an update is planned.

Thank you,
Christoph

 

[TheodorosG_3CX]

I wanted to inform you that we are already looking into the matter. We will share additional details once available.

 

[Nee_BinaryCity]

Hello,


I just wanted to report that 3CXDesktopApp.exe might be vulnerable to
CVE-2023-4863

I’ve checked the latest version, as well as an older one:

3CX Desktop App Version:18.10.461.
$ strings 3CXDesktopApp.exe |grep '^Chrome/[0-9.]* Electron/[0-9]'
Chrome/102.0.5005.148 Electron/19.0.8

And the latest version:
3CXDesktopApp/app-18.13.959$ strings 3CXDesktopApp.exe |grep '^Chrome/[0-9.]* Electron/[0-9]'
Chrome/112.0.5615.165 Electron/24.3.0

Please let me know if and when an update is planned.

Thank you,
Christoph

Hi, is there any update on this, perhaps?

 

[Agathocles Prodromou]

Hi there,

We have no further information at this time. You should consider using the Webclient/ PWA or the new Windows Softphone via the app store which is the way forward, as electron will not be receiving further updates.

 

[SteveITS]

new Windows Softphone

This works with v20 and later, correct?

 

[SweetAction]

This works with v20 and later, correct?

And even v18.

 

[SteveITS]

And even v18.

Ah. The instructions don't mention 18 and are incorrect/incomplete for 18 (no specific Provision button, use Download), but it does work, thanks.

There are some things missing but that's not for this thread.