Vulnerability Database

289,782

Total vulnerabilities in the database

CVE-2018-12227

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints.

  • Published: Jun 12, 2018
  • Updated: Apr 13, 2023
  • CVE: CVE-2018-12227
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 5.3
  • AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

Software From Fixed in
digium / asterisk 13.0.0 13.21.1
digium / asterisk 14.0.0.x 14.7.7
digium / asterisk 15.0.0 15.4.1
digium / certified_asterisk 13.18-cert1 13.18-cert1.x
digium / certified_asterisk 13.18-cert2 13.18-cert2.x
digium / certified_asterisk 13.18-cert3 13.18-cert3.x
digium / certified_asterisk 13.21-cert1 13.21-cert1.x
debian / debian_linux 9.0 9.0.x