CVE-2024-35190

2024-05-1717:15:07

CWE-303

CWE-670

CWE-480

[email protected]

web.nvd.nist.gov

asterisk

sip

vulnerability

fixed

versions

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1.

Affected configurations

Vulners

Node

asteriskasteriskMatch21.3.0

asteriskasteriskMatch20.8.0

asteriskasteriskMatch18.23.0

VendorProductVersionCPE
asteriskasterisk21.3.0cpe:2.3:a:asterisk:asterisk:21.3.0:*:*:*:*:*:*:*
asteriskasterisk20.8.0cpe:2.3:a:asterisk:asterisk:20.8.0:*:*:*:*:*:*:*
asteriskasterisk18.23.0cpe:2.3:a:asterisk:asterisk:18.23.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
asterisk	asterisk	21.3.0	cpe:2.3:a:asterisk:asterisk:21.3.0:::::::*
asterisk	asterisk	20.8.0	cpe:2.3:a:asterisk:asterisk:20.8.0:::::::*
asterisk	asterisk	18.23.0	cpe:2.3:a:asterisk:asterisk:18.23.0:::::::*

CNA Affected

[
  {
    "vendor": "asterisk",
    "product": "asterisk",
    "versions": [
      {
        "version": "= 21.3.0",
        "status": "affected"
      },
      {
        "version": "= 20.8.0",
        "status": "affected"
      },
      {
        "version": "= 18.23.0",
        "status": "affected"
      }
    ]
  }
]