Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2022-26499

Опубликовано: 15 апр. 2022
Источник: nvd
CVSS3: 9.1
CVSS2: 6.4
EPSS Низкий

Описание

An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Версия от 16.15.0 (включая) до 16.25.1 (включая)
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Версия от 18.0 (включая) до 18.11.2 (исключая)
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Версия от 19.0.0 (включая) до 19.3.1 (включая)
Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

EPSS

Процентиль: 58%
0.00362
Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-918

Связанные уязвимости

ubuntu логотип

CVE-2022-26499

CVSS3: 9.1
ubuntu
почти 4 года назад

An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

debian логотип

CVE-2022-26499

CVSS3: 9.1
debian
почти 4 года назад

An SSRF issue was discovered in Asterisk through 19.x. When using STIR ...

github логотип

GHSA-fwqw-pr3c-3j3r

CVSS3: 9.1
github
почти 4 года назад

An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

EPSS

Процентиль: 58%
0.00362
Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-918