CVE-2022-42706

2022-12-0521:15:10

Debian Security Bug Tracker

security-tracker.debian.org

sangoma

asterisk

unauthorized access

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

59.2%

JSON

An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to access files outside of the asterisk configuration directory, aka Directory Traversal.

OSVersionArchitecturePackageVersionFilename
Debian11allasterisk< 1:16.28.0~dfsg-0+deb11u2asterisk_1:16.28.0~dfsg-0+deb11u2_all.deb
Debian999allasterisk< 1:20.0.1~dfsg+~cs6.12.40431414-1asterisk_1:20.0.1~dfsg+~cs6.12.40431414-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	all	asterisk	< 1:16.28.0~dfsg-0+deb11u2	asterisk_1:16.28.0~dfsg-0+deb11u2_all.deb
Debian	999	all	asterisk	< 1:20.0.1~dfsg+~cs6.12.40431414-1	asterisk_1:20.0.1~dfsg+~cs6.12.40431414-1_all.deb