Sangoma: >> Asterisk >> 18.11.3 Security Vulnerabilities
In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.
CVSS Score
7.5
EPSS Score
0.002
Published
2022-12-05
An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to access files outside of the asterisk configuration directory, aka Directory Traversal.
CVSS Score
4.9
EPSS Score
0.002
Published
2022-12-05