3CX

{
  "id": 0,
  "url": "https://hackerone.com/3cx",
  "name": "3CX",
  "handle": "3cx",
  "targets": {
    "in_scope": [
      {
        "asset_type": "OTHER",
        "instruction": "This is a plugin that integrates 3CX Livechat into a WordPress site. A 3CX installation is required (On Premise or in the Cloud).\n\nLink to the plugin: https://wordpress.org/plugins/wp-live-chat-support/\nLink to the documentation: https://www.3cx.com/docs/manual/live-chat/",
        "max_severity": "medium",
        "asset_identifier": "3CX Live chat WordPress plugin",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "1. Register on www.3cx.com using your **hackerone email address**. Confirm your email and follow the wizard to select a deployment type. (Please refer to our documentation for more information about each deployment type https://www.3cx.com/docs/manual/install/)\n\n2. **There might be new builds in the repository after you have installed it. If you find a vulnerability, before submitting it, make sure you update to the latest available version and ensure it is still valid. This includes Alpha/Beta/RC versions.**\n\n3. For any additional technical documentation you can refer to our website.",
        "max_severity": "critical",
        "asset_identifier": "3CX Phone System",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "instruction": "1. 3CX SBC requires an existing installation of 3CX Server. \n\n2. Use the following ISO instead to deploy 3CX SBC on-premise: https://downloads-global.3cx.com/downloads/debian12iso/debian-amd64-netinst-3cx.iso . \n\n3. In the 3CX Installer select 3CX SBC (not PBX)\n\n4. During the Installation you will be asked to enter the PBX FQDN and SBC key.\n\n5. **There might be new builds in the repository after you have installed it. If you find a vulnerability, before submitting it, make sure you update to the latest available version (both 3CX PBX and 3CX SBC) and ensure it is still valid. This includes Alpha/Beta/RC versions.**\n\n6. For any additional technical documentation you can refer to our website.",
        "max_severity": "critical",
        "asset_identifier": "3CX SBC",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "",
        "max_severity": "none",
        "asset_identifier": "Other",
        "eligible_for_bounty": false,
        "integrity_requirement": "none",
        "eligible_for_submission": true,
        "availability_requirement": "none",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "URL",
        "instruction": "Endpoint used by the 3CX PBX to activate the product.",
        "max_severity": "critical",
        "asset_identifier": "activate.3cx.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Endpoint used by the 3CX PBX (and other services) to download various packages and files. \n\nIt contains sample configuration files which are commonly miscategorized as findings by researchers. ",
        "max_severity": "critical",
        "asset_identifier": "downloads-global.3cx.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": "The 3CX App allows you to make and receive calls, schedule conferences, video call and chat with your team and customers from anywhere. You install the app and provision it by scanning your extension's QR code.\n\nUser manual: https://www.3cx.com/user-manual/installation-iphone/",
        "max_severity": "critical",
        "asset_identifier": "https://apps.apple.com/us/app/3cx/id992045982",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WINDOWS_APP_STORE_APP_ID",
        "instruction": "The 3CX softphone app for Windows allows you to make calls, view the status of colleagues, chat, schedule a video conference and check voicemail from your desktop\n ",
        "max_severity": "critical",
        "asset_identifier": "https://apps.microsoft.com/detail/3cx/9NW77489NGJ0",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "The 3CX App allows you to make and receive calls, schedule conferences, video call and chat with your team and customers from anywhere. You install the app and provision it by scanning your extension's QR code. \n\nUser manual: https://www.3cx.com/user-manual/installation-android/",
        "max_severity": "critical",
        "asset_identifier": "https://play.google.com/store/apps/details?id=com.tcx.sipphone14",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "This is the portal where customers and partners can manage their 3CX account/license keys.",
        "max_severity": "critical",
        "asset_identifier": "https://portal.3cx.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Endpoint used by the 3CX PBX to send out emails.",
        "max_severity": "critical",
        "asset_identifier": "mailproxy.3cx.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Endpoint used by the 3CX PBX to download Debian packages.",
        "max_severity": "critical",
        "asset_identifier": "repo.3cx.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Endpoint used by the 3CX PBX for the provisioning of remote IP  phones. ",
        "max_severity": "critical",
        "asset_identifier": "rps.3cx.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Endpoint used by the 3CX PBX for the Webmeeting and transcription services.",
        "max_severity": "critical",
        "asset_identifier": "wmr.3cx.net",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ],
    "out_of_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": "Catch-all entry for any subdomain under *.3cx.com which is not explicitly in scope.",
        "max_severity": "none",
        "asset_identifier": "*.3cx.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "The free VoIP softphone found on https://www.3cx.com/voip/voip-phone/ is outside of scope.",
        "max_severity": "none",
        "asset_identifier": "3CX Phone 6.0",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ]
  },
  "website": "https://www.3cx.com",
  "offers_swag": false,
  "managed_program": false,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 67,
  "response_efficiency_percentage": 94,
  "average_time_to_report_resolved": 2932,
  "average_time_to_first_program_response": 20
}