CVE-2018-12227

Published: Jun 12, 2018Modified: Nov 21, 2024

5.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints.

Affected (8)

Products: Digium: Asterisk, Certified Asterisk · Debian: Debian Linux

2 products

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Digium Asterisk	After 14.0.0 to 14.7.7
Digium Asterisk	From 13.0.0 to 13.21.1
Digium Asterisk	From 15.0.0 to 15.4.1

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Digium Certified Asterisk	Version 13.18 cert1
Digium Certified Asterisk	Version 13.18 cert2
Digium Certified Asterisk	Version 13.18 cert3
Digium Certified Asterisk	Version 13.21 cert1