Summary
Low-privilege UCP user can inject arbitrary Asterisk Manager (AMI) actions via unstripped CRLF in call-forward values.
Authentication with a known username is required.
Common Vulnerabilities and Exposures (CVE)
Requested
GitHub Security Advisory (GHSA)
GHSA-3hr3-9whj-655f
Provider Urgency (choice of: Not Defined, Clear, Green, Amber, or Red)
G - Green
Link to Published GHSA with More Details
Highlights
