CVE-2023-49294

Summary

CVE-2023-49294 is a vulnerability affecting versions of Asterisk, an open source telephony toolkit, prior to 18.20.1, 20.5.1, and 21.0.1, and certified-asterisk prior to 18.9-cert6. The issue enables an attacker to read arbitrary files, bypassing the security measure that requires the `live_dangerously` option to be enabled. The vulnerability is significant as it can potentially expose sensitive information. Users are advised to update to the fixed versions, 18.20.1, 20.5.1, and 21.0.1, or certified-asterisk versions after 18.9-cert6, to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.