CVEvulnerability

CVE-2012-2186

9.0 HIGH Published 2012-08-31 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-08-31
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C

Description

Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action.

Affected configurations

• asterisk open source 1.8.0 • asterisk open source 1.8.1 • asterisk open source 1.8.1.1 • asterisk open source 1.8.1.2 • asterisk open source 1.8.2 • asterisk open source 1.8.2.1 • asterisk open source 1.8.2.2 • asterisk open source 1.8.2.3 • asterisk open source 1.8.2.4 • asterisk open source 1.8.3 • asterisk open source 1.8.3.1 • asterisk open source 1.8.3.2 • asterisk open source 1.8.3.3 • asterisk open source 1.8.4 • asterisk open source 1.8.4.1 • asterisk open source 1.8.4.2 • asterisk open source 1.8.4.3 • asterisk open source 1.8.4.4 • asterisk open source 1.8.5 • asterisk open source 1.8.5.0 • asterisk open source 1.8.6.0 • asterisk open source 1.8.7 • asterisk open source 1.8.7.0 • asterisk open source 1.8.7.1 • asterisk open source 1.8.7.2 • asterisk open source 1.8.8.0 • asterisk open source 1.8.8.1 • asterisk open source 1.8.8.2 • asterisk open source 1.8.9.0 • asterisk open source 1.8.9.1 • asterisk open source 1.8.9.2 • asterisk open source 1.8.9.3 • asterisk open source 1.8.10.0 • asterisk open source 1.8.10.1 • asterisk open source 1.8.11.0 • asterisk open source 1.8.11.1 • asterisk open source 1.8.12 • asterisk open source 1.8.12.0 • sangoma asterisk (<= 1.8.15.0) • asterisk open source 10.0.0 • asterisk open source 10.0.1 • asterisk open source 10.1.0 • asterisk open source 10.1.1 • asterisk open source 10.1.2 • asterisk open source 10.1.3 • asterisk open source 10.2.0 • asterisk open source 10.2.1 • asterisk open source 10.3 • asterisk open source 10.3.0 • asterisk open source 10.3.1 • asterisk open source 10.4.0 • sangoma asterisk (<= 10.7.0) • asterisk certified asterisk (<= 1.8.11) • asterisk certified asterisk 1.8.11 • asterisk digiumphones (<= 10.7.0) • asterisk business edition (<= c.3.7.5) • asterisk business edition c.3.0

References