July 10, 2024, 12:15 p.m.

CVE has been recently published to the CVE List and has been received by the NVD.



  • 0.1
  • 1.0
  • 2.0
  • 2.7



CVE-2024-3799 details

Published : July 10, 2024, 12:15 p.m.
Last Modified : July 10, 2024, 12:15 p.m.


Insecure handling of POST header parameter body included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reaches the server, it will cause a shell command execution. This issue affects Phoniebox in all releases through 2.7. Newer releases were not tested, but they might also be vulnerable.

CVSS Score

1 2 3 4 5 6 7 8 9 10


Weakness Name Description
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
This website uses the NVD API, but is not approved or certified by it.