| Vulnerability Name: | CVE-2014-8413 (CCN-98864) | ||||||||||||
| Assigned: | 2014-11-20 | ||||||||||||
| Published: | 2014-11-20 | ||||||||||||
| Updated: | 2019-07-16 | ||||||||||||
| Summary: | The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules. | ||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P) 5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||||||
| Vulnerability Type: | CWE-264 | ||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2014-8413 Source: CCN Type: Asterisk Project Security Advisory - AST-2014-013 PJSIP ACLs are not loaded on startup Source: CONFIRM Type: Vendor Advisory http://downloads.asterisk.org/pub/security/AST-2014-013.html Source: CCN Type: BID-71221 Asterisk Open Source 'res_pjsip_acl' Module Security Bypass Vulnerability Source: XF Type: UNKNOWN asterisk-respjsopacl-sec-bypass(98864) | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||