CVE-2024-53566

Name

CVE-2024-53566

Description

An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.

NVD Severity

unknown

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

References

Type	URI
	https://github.com/asterisk/asterisk/blob/22/main/manager.c#L2556
	https://gist.github.com/hyp164D1/e7c0f44ffb38c00320aa1a6d98bee616
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/02/msg00003.html

Match rules

CPE URI	Source package	Min version	Max version
	n/a	== n/a	== n/a

Vulnerable and fixed packages

Source package	Branch	Version	Maintainer	Status
asterisk	edge-main	20.11.1-r0	Timo Teras <timo.teras@iki.fi>	fixed
asterisk	3.22-main	20.11.1-r0	None	fixed
asterisk	3.21-main	20.11.1-r0	Timo Teras <timo.teras@iki.fi>	fixed
asterisk	3.20-main	20.9.3-r1	Timo Teras <timo.teras@iki.fi>	fixed
asterisk	3.19-main	20.9.3-r1	Timo Teras <timo.teras@iki.fi>	fixed
asterisk	3.18-main	18.24.3-r1	Timo Teras <timo.teras@iki.fi>	fixed