CVE-2023-49294 Asterisk Path Traversal vulnerability
Attackers can read arbitrary files on Asterisk servers, potentially exposing sensitive data, regardless of the live_dangerously configuration setting.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49294?
CVE-2023-49294 is a medium-severity path traversal vulnerability in Digium Asterisk, published on 14 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.
Weakness: CWE-22
Which versions are affected by CVE-2023-49294?
It affects 2 products.
Products include Digium Asterisk, Sangoma Certified Asterisk.
How do I fix CVE-2023-49294?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-49294 being exploited?
There is no known exploitation of CVE-2023-49294 in the wild and no public exploit code.
Other vulnerabilities in Digium Asterisk
Sources
Also known as ALPINE-CVE-2023-49294, CVE-2024-49215, DEBIAN-CVE-2023-49294, GHSA-8857-hfmw-vg8f, UBUNTU-CVE-2023-49294.