CVE-2023-49294CWE-22

Asterisk Path Traversal vulnerability

Medium · published December 14, 2023

CVSS v3.1

4.9

EPSS

45%

Percentile

98.8

In the wild

Unconfirmed

What it is

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.

The record

Technical detail

CVSS v3.1: 4.9 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.45293 · 98.8th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2023-12-14T19:40Z

EPSS history

Timeline

14 DEC 19:40Z
Asterisk Path Traversal vulnerability
cvelistv5