CVE-2023-49294
Last modified
CVE-2023-49294 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. EPSS estimates a 45.57% chance of exploitation in the next 30 days.
Description
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Digium | Asterisk | < 18.20.1 | — |
| Digium | Asterisk | >= 19.0.0, < 20.5.1 | — |
| Digium | Asterisk | 21.0.0 | — |
| Sangoma | Certified Asterisk | 13.13.0 | — |
| Sangoma | Certified Asterisk | 16.8.0 | — |
| Sangoma | Certified Asterisk | 18.9 | Cert1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-49294?
How severe is CVE-2023-49294?
How do I fix CVE-2023-49294?
Are you affected by CVE-2023-49294?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST