« Volver al listado

CVE-2014-8413

Estado: ModificadaAlta (7.5)—

The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Digium — Asterisk

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-8413",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-11-24T15:59:05.310",
  "references": [
    {
      "url": "http://downloads.asterisk.org/pub/security/AST-2014-013.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://downloads.asterisk.org/pub/security/AST-2014-013.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules."
    },
    {
      "lang": "es",
      "value": "El módulo res_pjsip_acl en Asterisk Open Source 12.x en versiones anteriores a 12.7.1 y 13.x en versiones anteriores a 13.0.1 no crea y carga adecuadamente ACLs definidos en pjsip.conf en el arranque, lo que permite a atacantes remotos eludir las reglas previstas para PJSIP ACL."
    }
  ],
  "lastModified": "2026-06-17T00:16:41.447",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F21F0B73-A30F-4673-B3A8-D9F456FFCEF2",
              "versionEndExcluding": "12.7.1",
              "versionStartIncluding": "12.0.0"
            },
            {
              "criteria": "cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C83CD93-7CBA-4FF0-B29E-A509F4A3D5E2",
              "versionEndExcluding": "13.0.1",
              "versionStartIncluding": "13.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}