CVE-2023-49294

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-49294
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49294.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-49294
Aliases
  • GHSA-8857-hfmw-vg8f
Downstream
Published
2023-12-14T19:40:46.157Z
Modified
2026-07-08T08:11:40.657105955Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Asterisk Path Traversal vulnerability
Details

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the live_dangerously is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49294.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/asterisk/asterisk

Affected ranges

Type
GIT
Repo
https://github.com/asterisk/asterisk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
14d0e59f3d8f7521621561168ef4a297702d978f
Introduced
de4f63b4824c91a0cd9f3d95f3b7923bec71960c
Fixed
f7a8ac086de697db30e376d589a6f4e17cfabef5
Introduced
12da95e53ff42287ad69d6d5922e06c3d62010ac
Fixed
424be345639d75c6cb7d0bd2da5f0f407dbd0bd5
Database specific 
{
    "cpe": [
        "cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:digium:asterisk:21.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:13.13.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:13.13.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:16.8.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "18.20.1"
        },
        {
            "introduced": "19.0.0"
        },
        {
            "fixed": "20.5.1"
        },
        {
            "introduced": "21.0.0"
        },
        {
            "last_affected": "21.0.0"
        },
        {
            "introduced": "13.13.0"
        },
        {
            "last_affected": "13.13.0"
        },
        {
            "introduced": "13.13.0-rc1"
        },
        {
            "last_affected": "13.13.0-rc1"
        },
        {
            "introduced": "13.13.0-rc2"
        },
        {
            "last_affected": "13.13.0-rc2"
        },
        {
            "introduced": "16.8.0-NA"
        },
        {
            "last_affected": "16.8.0-NA"
        },
        {
            "introduced": "18.9-cert1"
        },
        {
            "last_affected": "18.9-cert1"
        },
        {
            "introduced": "18.9-cert2"
        },
        {
            "last_affected": "18.9-cert2"
        },
        {
            "introduced": "18.9-cert3"
        },
        {
            "last_affected": "18.9-cert3"
        },
        {
            "introduced": "18.9-cert4"
        },
        {
            "last_affected": "18.9-cert4"
        },
        {
            "introduced": "18.9-cert5"
        },
        {
            "last_affected": "18.9-cert5"
        }
    ]
}

Affected versions

13.*
13.13.0
13.13.0-rc1
13.13.0-rc2
16.*
16.8.0-NA
18.*
18.17.0
18.17.0-rc1
18.17.1
18.18.0
18.18.0-rc1
18.18.1
18.19.0
18.19.0-rc1
18.19.0-rc2
18.20.0
18.20.0-rc1
18.9-cert1
18.9-cert2
18.9-cert3
18.9-cert4
18.9-cert5
20.*
20.2.0
20.2.0-rc1
20.2.1
20.3.0
20.3.0-rc1
20.3.1
20.4.0
20.4.0-rc1
20.4.0-rc2
20.5.0
20.5.0-rc1
21.*
21.0.0
= 21.*
= 21.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49294.json"