CVE-2023-49294 - CVE House

Back to Database

Status published Medium CVE-2023-49294

Asterisk Path Traversal vulnerability

4.9 CVSS

Vulnerability Description

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-49294

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from asterisk

View All →

Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request

Asterisk remotely exploitable leak of RTP UDP ports and internal resources

Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation

cli_permissions.conf: deny option does not work for disallowing shell commands

Using malformed From header can forge identity with ";" or NULL in name portion

Affected Vendor

asterisk

View all reports →

Affected Software

asterisk

Vulnerable Versions:

< 18.20.1, >= 19.0.0, < 20.5.1, = 21.0.0, < 18.9-cert6

Timeline

Official Publish: December 14th, 2023

Last Modified: February 13th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1565.001 Stored Data Manipulation