(High Risk) Unsupported JavaScript Libraries in use on 3CX

[simbar]

We have just had an external pen test carried out which has come back with the following issues for 3CX. We are running the latest version of 3CX.

Description:
According to its version, the installation of JavaScript running on the remote host is no longer supported. A lack of support implies that no new security patches will be released for it

References:

• https://endoflife.date/bootstrap
• https://www.npmjs.com/package/angular

Evidence:

• Bootstrap 3.3.7, Path: https://3cx.xxx.com/styles.a57dcc8fa225908b.css
• Bootstrap 3.4.1 & AngularJS 1.8.3, Path: https://3cx.xxx.com/vendor.874548bbc461f7e3.js

To what extent does 3CX maintain these and apply appropriate fixes for any security vulnerabilities?

 

[JohnS_3CX]

Hi you can contact us at [email protected] and share the details of your test results please?

 

[Nuggets]

Hi has there been any progress on this issue. I was made aware of this vulnerability as well.

styles.a57dcc8fa225908b.css

 

[Nuggets]

Hi is there any updates to this vulnerability? @JohnS_3CX

 

[SweetAction]

You may wish to post this here: https://www.3cx.com/community/forums/security-alerts/