CVE-2022-42706

published 2022-12-05

CVE-2022-42706: An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk…

Priority P4 27 medium 4.9 CVSS 3.1

AV N AC L PR H UI N S U C H I N A N

An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to access files outside of the asterisk configuration directory, aka Directory Traversal.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	asterisk	< asterisk 1:16.28.0~dfsg-0+deb11u2 (bullseye)	asterisk 1:16.28.0~dfsg-0+deb11u2 (bullseye)
sangoma	asterisk	—	—
sangoma	asterisk	>= 0 < 1:16.28.0~dfsg-0+deb11u2	1:16.28.0~dfsg-0+deb11u2
sangoma	asterisk	>= 16.0.0 < 16.29.1	16.29.1
sangoma	asterisk	>= 17.0.0 < 18.15.1	18.15.1
sangoma	asterisk	>= 19.0.0 < 19.7.1	19.7.1
sangoma	certified_asterisk	< 18.9	18.9
sangoma	certified_asterisk	—	—

CVSS provenance

nvd v3.1 4.9 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

osv 4.9 MEDIUM

vendor_debian 4.9 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22