3CX

{
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 107,
  "average_time_to_first_program_response": 8,
  "average_time_to_report_resolved": 3222,
  "handle": "3cx",
  "id": 0,
  "managed_program": true,
  "name": "3CX",
  "offers_bounties": true,
  "offers_swag": false,
  "response_efficiency_percentage": 95,
  "submission_state": "open",
  "url": "https://hackerone.com/3cx",
  "website": "https://www.3cx.com",
  "targets": {
    "in_scope": [
      {
        "asset_identifier": "3CX Live chat WordPress plugin",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "This is a plugin that integrates 3CX Livechat into a WordPress site. A 3CX installation is required (On Premise or in the Cloud).\n\nLink to the plugin: https://wordpress.org/plugins/wp-live-chat-support/\nLink to the documentation: https://www.3cx.com/docs/manual/live-chat/",
        "integrity_requirement": null,
        "max_severity": "medium"
      },
      {
        "asset_identifier": "3CX Phone System",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "1. Register on www.3cx.com using your **hackerone email address**. Confirm your email and follow the wizard to select a deployment type. (Please refer to our documentation for more information about each deployment type https://www.3cx.com/docs/manual/install/)\n\n2. **There might be new builds in the repository after you have installed it. If you find a vulnerability, before submitting it, make sure you update to the latest available version and ensure it is still valid. On linux you can manually update by running `apt update && apt upgrade` in your server's terminal.**\n\n3. For any additional technical documentation you can refer to our website.",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "3CX SBC",
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "1. 3CX SBC requires an existing installation of 3CX Server. \n\n2. Use the following ISO instead to deploy 3CX SBC on-premise: https://downloads-global.3cx.com/downloads/debian12iso/debian-amd64-netinst-3cx.iso . \n\n3. In the 3CX Installer select 3CX SBC (not PBX)\n\n4. During the Installation you will be asked to enter the PBX FQDN and SBC key.\n\n5. **There might be new builds in the repository after you have installed it. If you find a vulnerability, before submitting it, make sure you update to the latest available version (both 3CX PBX and 3CX SBC) and ensure it is still valid. You can update by running `apt update && apt upgrade` in your server's terminal.**\n\n6. For any additional technical documentation you can refer to our website.",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "Other",
        "asset_type": "OTHER",
        "availability_requirement": "none",
        "confidentiality_requirement": "none",
        "eligible_for_bounty": false,
        "eligible_for_submission": true,
        "instruction": "",
        "integrity_requirement": "none",
        "max_severity": "none"
      },
      {
        "asset_identifier": "https://apps.apple.com/us/app/3cx/id992045982",
        "asset_type": "APPLE_STORE_APP_ID",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "The 3CX App allows you to make and receive calls, schedule conferences, video call and chat with your team and customers from anywhere. You install the app and provision it by scanning your extension's QR code.\n\nUser manual: https://www.3cx.com/user-manual/installation-iphone/",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "https://apps.microsoft.com/detail/3cx/9NW77489NGJ0",
        "asset_type": "WINDOWS_APP_STORE_APP_ID",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "The 3CX softphone app for Windows allows you to make calls, view the status of colleagues, chat, schedule a video conference and check voicemail from your desktop\n ",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "https://play.google.com/store/apps/details?id=com.tcx.sipphone14",
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "The 3CX App allows you to make and receive calls, schedule conferences, video call and chat with your team and customers from anywhere. You install the app and provision it by scanning your extension's QR code. \n\nUser manual: https://www.3cx.com/user-manual/installation-android/",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "https://portal.3cx.com",
        "asset_type": "URL",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "This is the portal where customers and partners can manage their 3CX account/license keys.",
        "integrity_requirement": null,
        "max_severity": "critical"
      }
    ],
    "out_of_scope": [
      {
        "asset_identifier": "*.3cx.com",
        "asset_type": "WILDCARD",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "",
        "integrity_requirement": null,
        "max_severity": "none"
      }
    ]
  }
}