Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2012-2414

Date: April 30, 2012

main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action.

Language: C

Severity Score

Related Resources (12)

http://www.debian.org/security/2012/dsa-2460
https://exchange.xforce.ibmcloud.com/vulnerabilities/75100
http://www.securityfocus.com/bid/53206
http://osvdb.org/81454
http://secunia.com/advisories/48891
http://www.securitytracker.com/id?1026961
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079759.html
http://downloads.asterisk.org/pub/security/AST-2012-004.html
http://secunia.com/advisories/48941
https://nvd.nist.gov/vuln/detail/CVE-2012-2414
https://security-tracker.debian.org/tracker/CVE-2012-2414
https://www.mend.io/vulnerability-database/CVE-2012-2414

Severity Score

Weakness Type (CWE)

Authentication Issues

CWE-287

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us