CVE-2007-6170

2007-11-3001:46:00

CWE-89

[email protected]

web.nvd.nist.gov

sql injection

vulnerability

asterisk

cdr

postgresql

logging engine

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.6 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

59.5%

JSON

SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.

Affected configurations

NVD

Node

digiumasteriskRange1.2.0–1.2.25

digiumasteriskRange1.4.0–1.4.15

digiumasteriskRangeb.2.3.0–b.2.3.4business

digiumasteriskMatchc.1.0beta1business

digiumasteriskMatchc.1.0beta2business

digiumasteriskMatchc.1.0beta3business

digiumasteriskMatchc.1.0beta4business

digiumasteriskMatchc.1.0beta5business

Node

debiandebian_linuxMatch3.1

debiandebian_linuxMatch4.0

CPENameOperatorVersion
digium:asteriskdigium asterisklt1.2.25
digium:asteriskdigium asterisklt1.4.15
digium:asteriskdigium asteriskltb.2.3.4
digium:asteriskdigium asteriskeqc.1.0

CPE	Name	Operator	Version
digium:asterisk	digium asterisk	lt	1.2.25
digium:asterisk	digium asterisk	lt	1.4.15
digium:asterisk	digium asterisk	lt	b.2.3.4
digium:asterisk	digium asterisk	eq	c.1.0