Back to Database
Status published
Critical
CVE-2022-26499
An SSRF issue was discovered in Asterisk through 19.x. When...
Vulnerability Description
An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-26499
Credits & Attribution
No credits recorded in the NVD database.
References
- https://downloads.asterisk.org/pub/security/
- https://downloads.asterisk.org/pub/security/AST-2022-002.html
- http://packetstormsecurity.com/files/166745/Asterisk-Project-Security-Advisory-AST-2022-002.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://www.debian.org/security/2022/dsa-5285
More from digium
View All →CVE-2022-26651
An issue was discovered in Asterisk through 19.x and Certified...
Critical
9.8
CVE-2022-26498
An issue was discovered in Asterisk through 19.x. When using...
High
7.5
CVE-2021-32558
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3,...
High
7.5
CVE-2021-31878
An issue was discovered in PJSIP in Asterisk before 16.19.1...
Medium
6.5
CVE-2021-26906
An issue was discovered in res_pjsip_session.c in Digium Asterisk through...
Medium
5.9
Affected Vendor
digium
View all reports →Affected Software
asterisk, debian linux
Vulnerable Versions:
16.15.0, 18.0, 19.0.0, 10.0, 11.0
Timeline
Official Publish:
April 15th, 2022
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.