Authorization

2012-04-3020:55:00

PRIOn knowledge base

www.prio-n.com

7.6 High

AI Score

Confidence

Low

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.919 High

EPSS

Percentile

98.9%

JSON

main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action.

CPENameOperatorVersion
open_sourceeq1.6.2.0 rc4
open_sourceeq1.6.2.15.1
open_sourceeq1.6.2.10 rc1
open_sourceeq1.6.2.9 rc3
open_sourceeq1.6.2.17 rc1
open_sourceeq1.6.2.1
open_sourceeq1.6.2.2
open_sourceeq1.6.2.14
open_sourceeq1.6.2.17 rc3
open_sourceeq1.6.2.22

Name	Operator	Version
open_source	eq	1.6.2.0 rc4
open_source	eq	1.6.2.15.1
open_source	eq	1.6.2.10 rc1
open_source	eq	1.6.2.9 rc3
open_source	eq	1.6.2.17 rc1
open_source	eq	1.6.2.1
open_source	eq	1.6.2.2
open_source	eq	1.6.2.14
open_source	eq	1.6.2.17 rc3
open_source	eq	1.6.2.22