Design/Logic Flaw

2014-11-2415:59:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

81.9%

JSON

The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules.

CPENameOperatorVersion
asteriskge12.0.0
asterisklt12.7.1
asteriskge13.0.0
asterisklt13.0.1

Name	Operator	Version
asterisk	ge	12.0.0
asterisk	lt	12.7.1
asterisk	ge	13.0.0
asterisk	lt	13.0.1

References

downloads.asterisk.org/pub/security/AST-2014-013.html