VulnerabilityModified
CVE-2018-7287
An issue was discovered in res_http_websocket.c in Asterisk 15.x through 15.2.1.
MEDIUM 5.9EPSS 11.5%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.5%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
An issue was discovered in res_http_websocket.c in Asterisk 15.x through 15.2.1. If the HTTP server is enabled (default is disabled), WebSocket payloads of size 0 are mishandled (with a busy loop).
- CVSS 3.0
- 5.9 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 11.45% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-754
- Affected
- digium/asterisk
- Source
- cve@mitre.org
References
- http://downloads.digium.com/pub/security/AST-2018-006.htmlVendor Advisory
- http://www.securityfocus.com/bid/103120Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040419Third Party Advisory, VDB Entry
- https://issues.asterisk.org/jira/browse/ASTERISK-27658Vendor Advisory
- http://downloads.digium.com/pub/security/AST-2018-006.htmlVendor Advisory
- http://www.securityfocus.com/bid/103120Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040419Third Party Advisory, VDB Entry
- https://issues.asterisk.org/jira/browse/ASTERISK-27658Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.