| Vulnerability Name: | CCN-89826 | ||||||
| Published: | 2013-12-16 | ||||||
| Updated: | 2013-12-16 | ||||||
| Summary: | Asterisk could allow a remote authenticated attacker gain elevated privileges on the system, caused by the failure to restrict access to external control products. An attacker could exploit this vulnerability to gain access to dialplan functions to modify arbitrary files or execute arbitrary commands on the system. | ||||||
| CVSS v3 Severity: | 5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
| ||||||
| CVSS v2 Severity: | 6.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P) 4.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||
| Vulnerability Consequences: | Gain Privileges | ||||||
| References: | Source: CCN Type: AST-2013-007 Asterisk Manager User Dialplan Permission Escalation Source: CCN Type: SA55907 Asterisk Security Bypass and Memory Corruption Vulnerabilities Source: CCN Type: BID-64367 Multiple Asterisk Products Dialplan Functions Remote Privilege Escalation Vulnerability Source: XF Type: UNKNOWN asterisk-dialplan-priv-esc(89826) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||