PT-2022-26511 · Sangoma+1 · Asterisk+1

Shawty · Published 2022-12-05 · Updated 2025-02-13 · CVE-2022-42706

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sangoma Asterisk versions 16.28 and earlier, 17, 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1

Description An issue was discovered in Sangoma Asterisk that allows a connected application to access files outside of the asterisk configuration directory via the Asterisk Manager Interface, specifically through the GetConfig function, resulting in a directory traversal issue.

Recommendations For versions 16.28 and earlier, 17, 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1, consider restricting access to the GetConfig function via the Asterisk Manager Interface until a patch is available. As a temporary workaround, consider disabling the Asterisk Manager Interface to minimize the risk of exploitation. Restrict access to sensitive files and directories to prevent unauthorized access.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2023-6874

ALT-PU-2025-2613

CVE-2022-42706

DLA-3335-1

DSA-5358-1

Affected Products

Alt Linux

Asterisk

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2022-42706 · Security Note
• https://downloads.asterisk.org/pub/security/AST-2022-009.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3335-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-42706 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-42706 · Vendor Advisory
• https://debian.org/security/2023/dsa-5358 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-42706 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-42706 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-42706 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-42706 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5358-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-42706 · Vendor Advisory
• https://security.alpinelinux.org/vuln/CVE-2022-42706 · Note
• https://t.me/cvenotify/39367 · Telegram Post
• https://t.me/cvenotify/44867 · Telegram Post