How severe is CVE-2019-13176?

CVE-2019-13176 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2019-13176 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (83rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-13176?

CVE-2019-13176 primarily affects 3cx. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-13176?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2019-13176 published?

CVE-2019-13176 was published on 2019-08-08 and last updated on 2026-06-17.

CVE-2019-13176

CVE-2019-13176 is a high-severity vulnerability in 3cx with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-611.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 2% (83rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-611
Affected product: 3cx
Published: 2019-08-08
Last modified: 2026-06-17

Description

An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XXE via a crafted XML document in POST data. There is potential to use this for SSRF (reading local files, outbound HTTP, and outbound DNS).

Frequently asked questions

What is CVE-2019-13176?: An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XXE via a crafted XML document in POST data. There is potential to use this for SSRF (reading local files, outbound HTTP, and outbound DNS).
How severe is CVE-2019-13176?: CVE-2019-13176 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2019-13176 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (83rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-13176?: CVE-2019-13176 primarily affects 3cx. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-13176?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2019-13176 published?: CVE-2019-13176 was published on 2019-08-08 and last updated on 2026-06-17.

References

https://www.logicallysecure.com/blog/3cx-phone-system-web-console-affected-by-xxe/

Affected products (3)

cpe:2.3:a:3cx:3cx:12.5:sp1:*:*:*:*:*:*
cpe:2.3:a:3cx:3cx:12.5:sp2:*:*:*:*:*:*
cpe:2.3:a:3cx:3cx:12.5.44178.1002:*:*:*:*:*:*:*

More vulnerabilities in 3cx

CVE-2023-49954 — Critical (CVSS 9.8): The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search…
CVE-2022-28005 — Critical (CVSS 9.8): An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An…
CVE-2021-45490 — Critical (CVSS 9.1): The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17…
CVE-2023-27362 — High (CVSS 7.8): 3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to…
CVE-2023-29059 — High (CVSS 7.8): 3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects…
CVE-2019-14935 — High (CVSS 7.8): 3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation…

All CVEs affecting 3cx →

Other CWE-611 (Improper Restriction of XML External Entity Reference (XXE)) vulnerabilities

CVE-2022-22486 — Critical (CVSS 10.0): IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when…
CVE-2019-14678 — Critical (CVSS 10.0): SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in…
CVE-2015-9280 — Critical (CVSS 10.0): MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.
CVE-2018-1000838 — Critical (CVSS 10.0): autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result…
CVE-2018-1000837 — Critical (CVSS 10.0): UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can…
CVE-2018-1000835 — Critical (CVSS 10.0): KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can…

Browse all CWE-611 (Improper Restriction of XML External Entity Reference (XXE)) vulnerabilities →