Search for vulnerabilities
Vulnerability details: VCID-zybw-9y7m-aaad
Vulnerability ID VCID-zybw-9y7m-aaad
Aliases CVE-2019-18790
Summary An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-862 Missing Authorization
System Score Found at
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00333 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00628 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00734 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00734 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00734 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00734 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00734 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00734 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00734 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00734 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00734 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00734 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.00734 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.04597 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.04597 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.04597 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.04597 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.05493 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.05493 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.05493 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.05493 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07022 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07027 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07418 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
epss 0.07719 https://api.first.org/data/v1/epss?cve=CVE-2019-18790
cvssv2 5.8 https://nvd.nist.gov/vuln/detail/CVE-2019-18790
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2019-18790
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2019-18790
Reference id Reference type URL
http://downloads.asterisk.org/pub/security/AST-2019-006.html
https://api.first.org/data/v1/epss?cve=CVE-2019-18790
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18790
https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html
https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html
https://www.asterisk.org/downloads/security-advisories
947381 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947381
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:cert1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:cert1:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:cert2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:cert2:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:cert3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:cert3:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:cert4:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:cert4:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:digium:certified_asterisk:13.21.0:rc1:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
CVE-2019-18790 https://nvd.nist.gov/vuln/detail/CVE-2019-18790
No exploits are available.
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-18790
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-18790
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-18790
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.70832
EPSS Score 0.00333
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.