CVE-2019-18610
high · 8.8An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.
8.8
CVSS
29.6%
EPSS (exploit prob.)
98th
EPSS percentile
2019-11-22
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-862
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| digium | asterisk | >= 13.0.0, < 13.29.2 |
| digium | asterisk | >= 16.0.0, < 16.6.2 |
| digium | asterisk | >= 17.0.0, < 17.0.1 |
| digium | certified_asterisk | 13.21.0 |
| digium | certified_asterisk | 13.21.0 |
| digium | certified_asterisk | 13.21.0 |
| digium | certified_asterisk | 13.21.0 |
| digium | certified_asterisk | 13.21.0 |
| digium | certified_asterisk | 13.21.0 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
Check a specific version with /api/v1/cve/match.
References
- http://downloads.asterisk.org/pub/security/AST-2019-007.html
- https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html
- https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html
- https://www.asterisk.org/downloads/security-advisories
- http://downloads.asterisk.org/pub/security/AST-2019-007.html
- https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html
- https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html
- https://www.asterisk.org/downloads/security-advisories
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2019-18610