Header Bypass Vulnerability in Kamailio for Sippy Softswitch
CVE-2020-28361

5.4MEDIUM

Key Information:

Vendor

Kamailio

Status
Kamailio
Vendor
CVE Published:
18 November 2020

What is CVE-2020-28361?

A vulnerability in Kamailio prior to version 5.4.0, utilized within Sippy Softswitch versions 4.5 through 5.2, permits attackers to bypass the header-removal protection mechanism by exploiting whitespace characters. This occurs specifically within the remove_hf function of the Kamailio textops module. If leveraged by an attacker with valid credentials, this vulnerability can disrupt internal call start and duration accounting processes, potentially leading to significant revenue loss for affected organizations.

References

https://packetstormsecurity.com/files/159030/Kamailio-5.4...
x_refsource_MISC
https://support.sippysoft.com/support/discussions/topics/...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.