Log in Start free

Vulnerability · Published Dec 14, 2023 · Assigned by GitHub_M

CVE-2023-49294Asterisk Path Traversal vulnerability

Medium 4.9

In plain English

A medium-severity path traversal in asterisk from asterisk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 45.3% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)45.3%top 1.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20asterisk20.5.1-r0ALPINE-CVE-2023-49294
Alpine:v3.21asterisk20.5.1-r0ALPINE-CVE-2023-49294
Alpine:v3.22asterisk20.5.1-r0ALPINE-CVE-2023-49294
Alpine:v3.23asterisk20.5.1-r0ALPINE-CVE-2023-49294
Alpine:v3.24asterisk20.5.1-r0ALPINE-CVE-2023-49294
Debian:14asterisk1:20.5.1~dfsg+~cs6.13.40431414-1DEBIAN-CVE-2023-49294
Ubuntu:22.04:LTSasteriskno fix listedUBUNTU-CVE-2023-49294
Ubuntu:24.04:LTSasteriskno fix listedUBUNTU-CVE-2023-49294
Ubuntu:25.10asteriskno fix listedUBUNTU-CVE-2023-49294
Ubuntu:26.04:LTSasteriskno fix listedUBUNTU-CVE-2023-49294
Ubuntu:26.10asteriskno fix listedUBUNTU-CVE-2023-49294

Affected products (as reported)

VendorProductVersions
asterisk asterisk < 18.20.1>= 19.0.0, < 20.5.1= 21.0.0< 18.9-cert6

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References