Main
Vulnerability Database
Exploits
ID:10936 - Exploit for Permissions, Privileges, and Access Controls in Certified Asterisk and Asterisk Open Source - CVE-2024-42365
ID:10936 - Exploit for Permissions, Privileges, and Access Controls in Certified Asterisk and Asterisk Open Source - CVE-2024-42365
Published: December 3, 2024
Vulnerability identifier: #VU95788
Vulnerability risk: Medium
CVE-ID: CVE-2024-42365
CWE-ID: CWE-264
Exploitation vector: Remote access
Vulnerable software:
Certified Asterisk
Asterisk Open Source
Certified Asterisk
Asterisk Open Source
Link to public exploit:
Vulnerability description
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to improper access restrictions for users with "write=originate" role. A remote user can alter all configuration files in the `/etc/asterisk/` directory and use a set of built-in features, such as Set+File, Set+Curl, Reload+manager, Reload+pbx_config to overwrite files and escalate privileges on the system.
Remediation
Install updates from vendor's website.