CVE-2023-49294

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-49294
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-49294.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-49294
Aliases
  • GHSA-8857-hfmw-vg8f
Downstream
Published
2023-12-14T19:40:46.157Z
Modified
2025-11-27T19:35:11.412453Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Asterisk Path Traversal vulnerability
Details

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the live_dangerously is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/blob/ee626f5d79d5817bb21d6f048dc0da4c4e383443/cves/2023/49xxx/CVE-2023-49294.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/asterisk/asterisk

Affected ranges

Type
GIT
Repo
https://github.com/asterisk/asterisk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
14d0e59f3d8f7521621561168ef4a297702d978f
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "18.20.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/asterisk/asterisk
Events
Introduced
de4f63b4824c91a0cd9f3d95f3b7923bec71960c
Fixed
f7a8ac086de697db30e376d589a6f4e17cfabef5
Database specific 
{
    "versions": [
        {
            "introduced": "19.0.0"
        },
        {
            "fixed": "20.5.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/asterisk/asterisk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
12da95e53ff42287ad69d6d5922e06c3d62010ac
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "= 21.0.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/asterisk/asterisk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
35e0c6c0f4ec35493e9a4bb938226722ded35c61
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "18.9-cert6"
        }
    ]
}

Affected versions

18.*

18.17.0
18.17.0-rc1
18.17.1
18.18.0
18.18.0-rc1
18.18.1
18.19.0
18.19.0-rc1
18.19.0-rc2
18.20.0
18.20.0-rc1
18.9.0
18.9.0-rc1

21.*

21.0.0
21.0.0-pre1
21.0.0-rc1

certified-18.*

certified-18.9-cert4
certified-18.9-cert5

certified/18.*

certified/18.9-cert1
certified/18.9-cert1-rc1
certified/18.9-cert2
certified/18.9-cert3
certified/18.9-cert4