CVEvulnerability

CVE-2022-42706

4.9 MEDIUM Published 2022-12-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-12-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22

Description

An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to access files outside of the asterisk configuration directory, aka Directory Traversal.

Affected configurations

• sangoma asterisk (>= 16.0.0 < 16.29.1) • sangoma asterisk (>= 17.0.0 < 18.15.1) • sangoma asterisk (>= 19.0.0 < 19.7.1) • sangoma asterisk 20.0.0 • sangoma certified asterisk (< 18.9) • sangoma certified asterisk 18.9

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References