Trixbox CE versions 2.8.0.4 and below and 2.6.2.3 and below suffer from an undocumented administrator account issue.
83ba649730d370ea6a395204cb7c043ae7ae654e8029479b2425a9c398496e24
Affected products:
-------------------------
Trixbox CE 2.8.0.4 and below
Trixbox CE 2.6.2.3 and below
----------
Details:
----------
Trixbox CE, an Asterisk and FreePBX based system ships with undocumented web admin.
The admin web interface can be accessed by user wwwadmin which grants full access to PBX configuration
including all trunks/extensions credentials and config changes.
----------
Solution:
----------
Remove wwwadmin from /usr/local/apache/passwd/wwwpasswd and/or /etc/trixbox/httpdconf/trixbox.conf
------------
Timeline:
------------
08/20/2010 Notification posted on trixbox.org
11/29/2010 Vendor acknowledged and scheduled fix for the next release.