CVE-2023-49294

Katalog CVE

CVSS 7.5 · High EPSS 45,3%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada digium asterisk, sangoma certified asterisk. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.

Rincian

Terbit di NVD

14 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

45,3% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/asterisk/asterisk/security/advisories/GHSA-8857-hfmw-vg8f advisory vendor
• https://github.com/asterisk/asterisk/commit/424be345639d75c6cb7d0bd2da5f0f407dbd0bd5 patch
• https://github.com/asterisk/asterisk/blob/master/main/manager.c#L3757 product
• https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html