CVE-2014-8413

published 2014-11-24

CVE-2014-8413: The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at…

Priority P3 41 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	asterisk	< asterisk 1:13.1.0~dfsg-1 (bullseye)	asterisk 1:13.1.0~dfsg-1 (bullseye)
digium	asterisk	>= 0 < 1:13.1.0~dfsg-1	1:13.1.0~dfsg-1
digium	asterisk	>= 12.0.0 < 12.7.1	12.7.1
digium	asterisk	>= 13.0.0 < 13.0.1	13.0.1

CVSS provenance

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

osv 7.5 HIGH

vendor_debian 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-264