Lucene search
HistoryNov 24, 2014 - 3:59 p.m.
CVE-2014-8413
cve-2014-8413
asterisk
open source
res_pjsip_acl
acl
pjsip.conf
remote attackers
bypass
security vulnerability
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
6.8 Medium
AI Score
Confidence
Low
0.008 Low
EPSS
Percentile
81.9%
The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules.
Affected configurations
Node
digiumasteriskRange12.0.0–12.7.1
ORdigiumasteriskRange13.0.0–13.0.1
| CPE | Name | Operator | Version |
|---|---|---|---|
| digium:asterisk | digium asterisk | lt | 12.7.1 |
| digium:asterisk | digium asterisk | lt | 13.0.1 |
Related
debiancve
debiancve
CVE-2014-8413
2014-11-24 15:59:05
nvd
nvd
CVE-2014-8413
2014-11-24 15:59:05
ubuntucve
ubuntucve
CVE-2014-8413
2014-11-24 00:00:00
prion
prion
Design/Logic Flaw
2014-11-24 15:59:00
cvelist
cvelist
CVE-2014-8413
2014-11-24 15:00:00
nessus
nessus
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
6.8 Medium
AI Score
Confidence
Low
0.008 Low
EPSS
Percentile
81.9%
Related for CVE-2014-8413