Report Security Vulnerabilities

[ACrosser]

Hi,

I was wondering what the appropriate channel would be for reporting vulnerabilities in the 3CX Phone System Management Console. I'd classify these as medium risk security issues. I contacted the support team and they said I should post here, but this also doesn't look like it is the correct location. These aren't super critical, but are still relevant issues that we believe should be addressed.

 

[Charles_3CX]

3CX takes security issues very seriously, Please let us know what vulnerabilities you reference for the 3cx management console.

 

[SweetAction]

Hi,

I was wondering what the appropriate channel would be for reporting vulnerabilities in the 3CX Phone System Management Console. I'd classify these as medium risk security issues. I contacted the support team and they said I should post here, but this also doesn't look like it is the correct location. These aren't super critical, but are still relevant issues that we believe should be addressed.

Be aware that the Management Console is going away in the next version (v20), so this might self resolve.

 

[SteveITS]

Management Console is going away

It will but per https://www.3cx.com/community/threads/question-about-3cx-v20-deployement.123878/post-582607 "V18 will be around for minimum 6 -12 months." (Partner forum link, apologies to OP)

 

[ACrosser]

I ended up finding a thread which listed [email protected] as an email address so I want an email there:
https://www.3cx.com/community/threads/security-contact.86579/

 

[Charles_3CX]

I ended up finding a thread which listed [email protected] as an email address so I want an email there:
https://www.3cx.com/community/threads/security-contact.86579/

Ok, thanks for letting us know.

 

[SweetAction]

It will but per https://www.3cx.com/community/threads/question-about-3cx-v20-deployement.123878/post-582607 "V18 will be around for minimum 6 -12 months." (Partner forum link, apologies to OP)

But.... you don't have to stay on v18 for 6-12 months, you can move to v20 at any time (and no more management console).

3CX is aware that the management console has security issues. It's one of the reasons for the admin console.

Lastly, I know what is posted on the forum for timelines. But I heard something possibly different earlier this week direct from Nick, so I am unsure what will actually happen.