CVE-2023-49294

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.

• CWE-22

• https://github.com/asterisk/asterisk/blob/master/main/manager.c#L3757Product
• https://github.com/asterisk/asterisk/commit/424be345639d75c6cb7d0bd2da5f0f407dbd0bd5Patch
• https://github.com/asterisk/asterisk/security/advisories/GHSA-8857-hfmw-vg8fVendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html
• https://github.com/asterisk/asterisk/blob/master/main/manager.c#L3757Product
• https://github.com/asterisk/asterisk/commit/424be345639d75c6cb7d0bd2da5f0f407dbd0bd5Patch
• https://github.com/asterisk/asterisk/security/advisories/GHSA-8857-hfmw-vg8fVendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html

Published

Dec 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49289Ajax.NET Professional (AjaxPro) is an AJAX framework for Mic…5.4
• CVE-2023-4929All firmware versions of the NPort 5000 Series are affected …8.8
• CVE-2023-49290lestrrat-go/jwx is a Go module implementing various JWx (JWA…5.3
• CVE-2023-49291tj-actions/branch-names is a Github action to retrieve branc…9.8
• CVE-2023-49292ecies is an Elliptic Curve Integrated Encryption Scheme for …4.8
• CVE-2023-49293Vite is a website frontend framework. When Vite's HTML trans…6.1
• CVE-2023-49295quic-go is an implementation of the QUIC protocol (RFC 9000,…6.5
• CVE-2023-49296The Arduino Create Agent allows users to use the Arduino Cre…6.1
• CVE-2023-49297PyDrive2 is a wrapper library of google-api-python-client th…7.8
• CVE-2023-49298OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain s…7.5
• CVE-2023-49299Improper Input Validation vulnerability in Apache DolphinSch…8.8
• CVE-2023-4930The Front End PM WordPress plugin before 11.4.3 does not blo…6.5