CVE-2014-8418

published 2014-11-24

CVE-2014-8418: The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk…

Priority P3 45 critical 9 CVSS 2.0

AV N AC L Au S C C I C A C

The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protocol, as demonstrated by the AMI protocol.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	asterisk	< asterisk 1:13.1.0~dfsg-1 (bullseye)	asterisk 1:13.1.0~dfsg-1 (bullseye)
digium	asterisk	>= 0 < 1:13.1.0~dfsg-1	1:13.1.0~dfsg-1
digium	asterisk	1.8.0 – 1.8.32.0	—
digium	asterisk	>= 11.0.0 < 11.14.1	11.14.1
digium	asterisk	>= 12.0.0 < 12.7.1	12.7.1
digium	certified_asterisk	—	—
digium	certified_asterisk	—	—
digium	certified_asterisk	—	—

CVSS provenance

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

osv 9.0 CRITICAL

vendor_debian 9.0 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-264