Asterisk PBX Vulnerability: Unauthorized SIP Requests Identified
CVE-2024-35190

5.8MEDIUM

Key Information:

Vendor
Asterisk
Status
Asterisk
Vendor
CVE Published:
17 May 2024

Summary

Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1.

Affected Version(s)

asterisk = 21.3.0 = 21.3.0

asterisk = 20.8.0 = 20.8.0

asterisk = 18.23.0 = 18.23.0

References

https://github.com/asterisk/asterisk/security/advisories/...
x_refsource_CONFIRM
https://github.com/asterisk/asterisk/pull/600
x_refsource_MISC
https://github.com/asterisk/asterisk/pull/602
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.