CVE-2019-18790

An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.

• CWE-862

• http://downloads.asterisk.org/pub/security/AST-2019-006.htmlPatch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/11/msg00038.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/04/msg00001.htmlMailing List, Third Party Advisory
• https://www.asterisk.org/downloads/security-advisoriesVendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2019-006.htmlPatch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/11/msg00038.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/04/msg00001.htmlMailing List, Third Party Advisory
• https://www.asterisk.org/downloads/security-advisoriesVendor Advisory

Published

Nov 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18781An open redirect vulnerability was discovered in Zoho Manage…6.1
• CVE-2019-18782SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 …5.3
• CVE-2019-18784SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x version…9.8
• CVE-2019-18785SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 …7.5
• CVE-2019-18786In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is un…5.5
• CVE-2019-1879A vulnerability in the CLI of Cisco Integrated Management Co…6.4
• CVE-2019-18791Lexmark printer MS812 and multiple older generation Lexmark …5.4
• CVE-2019-18792An issue was discovered in Suricata 5.0.0. It is possible to…9.1
• CVE-2019-18793Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR…6.1
• CVE-2019-18794The BASS Audio Library 2.4.14 under Windows is prone to a BA…6.5
• CVE-2019-18795The BASS Audio Library 2.4.14 under Windows is prone to a BA…6.5
• CVE-2019-18796The BASS Audio Library 2.4.14 under Windows is prone to a BA…6.5