Solved Vulnerable JavaScript Components, Latest Version of 3CX 18.0 Update 8 (Build 939)

[BigT55439]

We had an external pen test done and the red team was able to identify that 3CX is running Bootstrap v3.4.1, which is outdated and has possible vulnerabilities. This was found with the Burp web application scanner. What are 3CX plans to patch this?

Please advise.

 

[Agathocles Prodromou]

Hi there,

The vulnerability scanner may indicate that bootstrap is not on the latest version, however this does not mean it is vulnerable.

There is currently no plan for this to receive any update for the following reasons:

1. It is only being used in the Management Console which is being deprecated (removed) in V20
2. Version 3.4.1 does not seem to have any known vulnerabilities (Even if it did, they would need to apply to the context of our web application)

 

[NickKulkarni]

@Agathocles Prodromou
Would tend to agree with you on this but I think we can all understand how nervous people are about this sort of thing after what happened.

https://security.snyk.io/package/npm/bootstrap/3.4.1

Direct Vulnerabilities​

No direct vulnerabilities have been found for this package in Snyk’s vulnerability database. This does not include vulnerabilities belonging to this package’s dependencies.
Does your project rely on vulnerable package dependencies?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities (in both your packages & their dependencies) and provides automated fixes for free.

 

[Agathocles Prodromou]

@Agathocles Prodromou
Would tend to agree with you on this but I think we can all understand how nervous people are about this sort of thing after what happened.

Hi Nick,

I totally understand and that is one the reasons I provide feedback whenever possible and try to help customers understand the nature and context of each potential vulnerability reported by a security assessment on their 3CX server.