CVE-2024-35190

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-303CWE-480CWE-670

Affected software

No affected versions have been published.

Timeline

Published
May 17, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-351914.4Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code intoCVE-2024-351925.5Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted maliciouCVE-2024-351945.3Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memorCVE-2024-351955.6Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=FaCVE-2024-351962.0Sentry is a developer-first error tracking and performance monitoring platform. Sentry's Slack integration incorrectly records the incoming CVE-2024-351975.4gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and cheCVE-2024-351989.8TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls confCVE-2024-351998.2TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports CVE-2024-35204.3The Country State City Dropdown CF7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checCVE-2024-352005.3When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to tCVE-2024-352017.8Incorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated user to enable escalatioCVE-2024-352027.5Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by includi
CVE-2024-35190: Medium severity, CVSS 5.3 | Vulnix