VulnerabilityAnalyzed
CVE-2024-35190
After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server.
MEDIUM 5.3EPSS 0.57%
Does this matter?
Lower severity and a low EPSS score (0.57%). Track it; it rarely justifies an emergency change on its own.
Description
Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.57% probability · 45th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-303, CWE-480, CWE-670
- Affected
- sangoma/asterisk
- Source
- security-advisories@github.com
References
- https://github.com/asterisk/asterisk/commit/85241bd22936cc15760fd1f65d16c98be7aeaf6dPatch
- https://github.com/asterisk/asterisk/pull/600Issue Tracking, Patch
- https://github.com/asterisk/asterisk/pull/602Issue Tracking, Patch
- https://github.com/asterisk/asterisk/security/advisories/GHSA-qqxj-v78h-hrf9Exploit, Vendor Advisory
- https://github.com/asterisk/asterisk/commit/85241bd22936cc15760fd1f65d16c98be7aeaf6dPatch
- https://github.com/asterisk/asterisk/pull/600Issue Tracking, Patch
- https://github.com/asterisk/asterisk/pull/602Issue Tracking, Patch
- https://github.com/asterisk/asterisk/security/advisories/GHSA-qqxj-v78h-hrf9Exploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.