🟢 Authenticated admin can read any file via call recording report

Summary

The recording_report (Call Recording Report) commercial module allows downloading arbitrary files that are readable by the asterisk user.

Authentication with a known username is required.

Common Vulnerabilities and Exposures (CVE)

Requested

GitHub Security Advisory (GHSA)

GHSA-x6qq-4527-j9gf

Provider Urgency (choice of: Not Defined, Clear, Green, Amber, or Red)

G - Green

Link to Published GHSA with More Details

Highlights

:green_circle: