Ubuntu.comUB:CVE-2018-12227CVE-2018-12227
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.041 Low
EPSS
Percentile
92.1%
An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x
before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert
before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint
specific ACL rules block a SIP request, they respond with a 403 forbidden.
However, if an endpoint is not identified, then a 401 unauthorized response
is sent. This vulnerability just discloses which requests hit a defined
endpoint. The ACL rules cannot be bypassed to gain access to the disclosed
endpoints.
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.041 Low
EPSS
Percentile
92.1%