desktop app vulnerabity

[arispe]

Hi guys, by any change how can I report a vulnerability with 3CX macos app? I just double check is this affect macos desktop client or just windows/ios/android?

 

[SweetAction]

Looking up this CVE, it's saying that the app doesn't validate the SSL cert. It doesn't affect the macos or windows desktop apps, just the legacy windowsapp and mobile clients. It's also a year old and might even be patched by now, but I am unsure about this.

3CX did commit to fixing the issue with the mobile apps when it was disclosed. The old legacy WindowsApp shouldn't be used and likely won't be fixed.

More info:
https://nvd.nist.gov/vuln/detail/CVE-2021-45490

 

[Evolute IT]

Actually, we also got S1 flag the latest update of DesktopApp, not the legacy client.

You can clearly see in his screenshot that it's for the DesktopApp too.

Not sure why it gets flagged tho.

 

[SweetAction]

Actually, we also got S1 flag the latest update of DesktopApp, not the legacy client.

You can clearly see in his screenshot that it's for the DesktopApp too.

Not sure why it gets flagged tho.

I'm just going off the CVE number, which explicitly calls out that the electron apps are not affected. I've not actually tested the app to verify, so it may be an issue or it may just be that the scanners are wrong here.