Vulnerability · Published Dec 5, 2022 · Assigned by mitre
CVE-2022-42706
Medium 4.9
In plain English
A medium-severity path traversal in the asterisk package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)1.2%top 32.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to access files outside of the asterisk configuration directory, aka Directory Traversal.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | asterisk | 18.15.1-r0 | ALPINE-CVE-2022-42706 |
| Alpine:v3.21 | asterisk | 18.15.1-r0 | ALPINE-CVE-2022-42706 |
| Alpine:v3.22 | asterisk | 18.15.1-r0 | ALPINE-CVE-2022-42706 |
| Alpine:v3.23 | asterisk | 18.15.1-r0 | ALPINE-CVE-2022-42706 |
| Alpine:v3.24 | asterisk | 18.15.1-r0 | ALPINE-CVE-2022-42706 |
| Debian:14 | asterisk | 1:20.0.1~dfsg+~cs6.12.40431414-1 | DEBIAN-CVE-2022-42706 |
| Ubuntu:22.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2022-42706 |
| Ubuntu:24.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2022-42706 |
| Ubuntu:25.10 | asterisk | no fix listed | UBUNTU-CVE-2022-42706 |
| Ubuntu:26.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2022-42706 |
| Ubuntu:26.10 | asterisk | no fix listed | UBUNTU-CVE-2022-42706 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N