CVEvulnerability

CVE-2024-35190

5.3 MEDIUM Published 2024-05-17 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-05-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-303, CWE-480, CWE-670

Description

Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1.

Affected configurations

• sangoma asterisk 18.23.0 • sangoma asterisk 20.8.0 • sangoma asterisk 21.3.0

Related

Weakness · CWE (3)

  • CWE-303 Incorrect Implementation of Authentication Algorithm weakness
  • CWE-480 Use of Incorrect Operator weakness
  • CWE-670 Always-Incorrect Control Flow Implementation weakness

References