main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 01:39
Type | Values Removed | Values Added |
---|---|---|
References | () http://downloads.asterisk.org/pub/security/AST-2012-004.html - Patch, Vendor Advisory | |
References | () http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079759.html - | |
References | () http://osvdb.org/81454 - | |
References | () http://secunia.com/advisories/48891 - | |
References | () http://secunia.com/advisories/48941 - | |
References | () http://www.debian.org/security/2012/dsa-2460 - | |
References | () http://www.securityfocus.com/bid/53206 - | |
References | () http://www.securitytracker.com/id?1026961 - | |
References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/75100 - |
Information
Published : 2012-04-30 20:55
Updated : 2024-11-21 01:39
NVD link : CVE-2012-2414
Mitre link : CVE-2012-2414
CVE.ORG link : CVE-2012-2414
JSON object : View
Products Affected
asterisk
- open_source
CWE
CWE-287
Improper Authentication