CVE-2023-49294
CVSS V2 None
CVSS V3 None
Description
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.
Overview
- CVE ID
- CVE-2023-49294
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2023-12-14T19:40:46.157Z
- Last Modified Date
- 2023-12-14T19:40:46.157Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/asterisk/asterisk/security/advisories/GHSA-8857-hfmw-vg8f | x_refsource_CONFIRM |
| https://github.com/asterisk/asterisk/commit/424be345639d75c6cb7d0bd2da5f0f407dbd0bd5 | x_refsource_MISC |
| https://github.com/asterisk/asterisk/blob/master/main/manager.c#L3757 | x_refsource_MISC |
| https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-49294 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49294 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-25 13:05:38 | Added to TrackCVE |