3.5Low
CVE-2026-23738The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
Weakness (CWE):
CWE-79
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
References and patches
CPE matches (NVD) (15)
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*≤ 20.18.2cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*≥ 21.0.0 ≤ 21.12.1cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*≥ 22.0.0 ≤ 22.8.2cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*≥ 23.0.0 < 23.2.2cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*≤ 18.9cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:*cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:*cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:*cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:*cpe:2.3:a:sangoma:certified_asterisk:20.7:cert7:*:*:*:*:*:*cpe:2.3:a:sangoma:certified_asterisk:20.7:cert8:*:*:*:*:*:*