{"api_version":"1","generated_at":"2026-07-23T10:42:42+00:00","cve":"CVE-2008-1390","urls":{"html":"https://cve.report/CVE-2008-1390","api":"https://cve.report/api/cve/CVE-2008-1390.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-1390","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-1390"},"summary":{"title":"CVE-2008-1390","description":"The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-03-24 17:44:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-255","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html","name":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] Fedora 8 Update: asterisk-1.4.18.1-1.fc8","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/3764","name":"http://securityreason.com/securityalert/3764","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityReason - HTTP Manager ID is predictable","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1019679","name":"http://www.securitytracker.com/id?1019679","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Asterisk Predictable Session IDs May Let Remote Users Hijack HTTP Manager Sessions - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/489819/100/0/threaded","name":"http://www.securityfocus.com/archive/1/489819/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/29470","name":"http://secunia.com/advisories/29470","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Fedora update for asterisk - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html","name":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] Fedora 7 Update: asterisk-1.4.18.1-1.fc7","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41304","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41304","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/28316","name":"http://www.securityfocus.com/bid/28316","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Asterisk Predictable HTTP Manager Session ID Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/29449","name":"http://secunia.com/advisories/29449","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Asterisk Predictable HTTP Manager ID Weakness - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://downloads.digium.com/pub/security/AST-2008-005.html","name":"http://downloads.digium.com/pub/security/AST-2008-005.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"AST-2008-005","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-1390","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1390","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.12","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.13","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.15","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.16","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.17","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.18.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4_beta","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.4_revision_95946","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk","cpe6":"1.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisknow","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisknow","cpe6":"beta_5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisknow","cpe6":"beta_6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisknow","cpe6":"beta_7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk_appliance_developer_kit","cpe6":"0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk_appliance_developer_kit","cpe6":"0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk_appliance_developer_kit","cpe6":"0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk_appliance_developer_kit","cpe6":"0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk_appliance_developer_kit","cpe6":"0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk_appliance_developer_kit","cpe6":"0.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk_appliance_developer_kit","cpe6":"0.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk_appliance_developer_kit","cpe6":"1.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk_business_edition","cpe6":"c.1.0-beta7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"asterisk_business_edition","cpe6":"c.1.0-beta8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"s800i","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"s800i","cpe6":"1.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"s800i","cpe6":"1.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"s800i","cpe6":"1.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"1390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"asterisk","cpe5":"s800i","cpe6":"1.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T08:17:34.588Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"3764","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/3764"},{"name":"28316","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/28316"},{"name":"20080318 AST-2008-005: HTTP Manager ID is predictable","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/489819/100/0/threaded"},{"name":"asterisk-httpmanagerid-weak-security(41304)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41304"},{"name":"29449","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/29449"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://downloads.digium.com/pub/security/AST-2008-005.html"},{"name":"FEDORA-2008-2554","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html"},{"name":"1019679","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1019679"},{"name":"FEDORA-2008-2620","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html"},{"name":"29470","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/29470"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-03-18T00:00:00.000Z","descriptions":[{"lang":"en","value":"The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-11T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"3764","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/3764"},{"name":"28316","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/28316"},{"name":"20080318 AST-2008-005: HTTP Manager ID is predictable","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/489819/100/0/threaded"},{"name":"asterisk-httpmanagerid-weak-security(41304)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41304"},{"name":"29449","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/29449"},{"tags":["x_refsource_CONFIRM"],"url":"http://downloads.digium.com/pub/security/AST-2008-005.html"},{"name":"FEDORA-2008-2554","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html"},{"name":"1019679","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1019679"},{"name":"FEDORA-2008-2620","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html"},{"name":"29470","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/29470"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-1390","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"3764","refsource":"SREASON","url":"http://securityreason.com/securityalert/3764"},{"name":"28316","refsource":"BID","url":"http://www.securityfocus.com/bid/28316"},{"name":"20080318 AST-2008-005: HTTP Manager ID is predictable","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/489819/100/0/threaded"},{"name":"asterisk-httpmanagerid-weak-security(41304)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41304"},{"name":"29449","refsource":"SECUNIA","url":"http://secunia.com/advisories/29449"},{"name":"http://downloads.digium.com/pub/security/AST-2008-005.html","refsource":"CONFIRM","url":"http://downloads.digium.com/pub/security/AST-2008-005.html"},{"name":"FEDORA-2008-2554","refsource":"FEDORA","url":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html"},{"name":"1019679","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1019679"},{"name":"FEDORA-2008-2620","refsource":"FEDORA","url":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html"},{"name":"29470","refsource":"SECUNIA","url":"http://secunia.com/advisories/29470"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-1390","datePublished":"2008-03-24T17:00:00.000Z","dateReserved":"2008-03-18T00:00:00.000Z","dateUpdated":"2024-08-07T08:17:34.588Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-03-24 17:44:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-255","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.1:*:*:*:*:*:*:*","matchCriteriaId":"593AA737-5AF3-4F7C-B74B-D3F37701C435"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.2:*:*:*:*:*:*:*","matchCriteriaId":"D942B911-979A-4AC3-93D6-07E420171E77"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.3:*:*:*:*:*:*:*","matchCriteriaId":"84CB8C4A-F001-4DD7-8DFE-CB082B4BB969"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.4:*:*:*:*:*:*:*","matchCriteriaId":"96DB0240-E93D-4BDB-859B-B44C91996993"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.5:*:*:*:*:*:*:*","matchCriteriaId":"0F4BA849-E092-404A-92CD-44C2D99AE971"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.6:*:*:*:*:*:*:*","matchCriteriaId":"2C7014B4-1860-49AD-9469-9954C3CC01C0"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.7:*:*:*:*:*:*:*","matchCriteriaId":"3D1F0056-0945-476C-982E-7B41EB420A99"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.8:*:*:*:*:*:*:*","matchCriteriaId":"A53DEC9D-B288-42CD-9387-57315AC98D72"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.9:*:*:*:*:*:*:*","matchCriteriaId":"89C1F33F-27B6-4C56-92FF-EB2861ABBC22"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.10:*:*:*:*:*:*:*","matchCriteriaId":"64E07CF3-073D-4705-96A6-13367D4F5CAA"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.11:*:*:*:*:*:*:*","matchCriteriaId":"18D19CB0-E3D7-40DB-B0C0-B62BB6075267"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.12:*:*:*:*:*:*:*","matchCriteriaId":"77FB7CC1-BD0D-4F34-AB21-59CFD23C494C"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.13:*:*:*:*:*:*:*","matchCriteriaId":"997FA3C7-1894-478A-ABF1-52DD2B0487E1"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.14:*:*:*:*:*:*:*","matchCriteriaId":"96E02BE0-BF4A-46C9-AFB5-47E8F18E3D17"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.15:*:*:*:*:*:*:*","matchCriteriaId":"292190EE-D9C8-4E3A-BB34-0ECD7B865482"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.16:*:*:*:*:*:*:*","matchCriteriaId":"7DAC55F9-1D43-4AA8-87C9-DB165442700B"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.17:*:*:*:*:*:*:*","matchCriteriaId":"195B012E-0538-4140-9035-F5D1A442778B"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4.18.1:*:*:*:*:*:*:*","matchCriteriaId":"78AC03A7-41AB-45AF-AD89-291A7429B8A0"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4_beta:*:*:*:*:*:*:*","matchCriteriaId":"181C8E98-2138-4BFC-B6B0-1DA270AEE7F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.4_revision_95946:*:*:*:*:*:*:*","matchCriteriaId":"DB08F4FA-8600-4D21-A565-B3BF636634B4"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk:1.6:*:*:*:*:*:*:*","matchCriteriaId":"FEAE6729-D79A-49B8-9758-BA74A60A238A"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.2:*:*:*:*:*:*:*","matchCriteriaId":"1C05B437-C292-4AA0-8AFE-1CA07CD80034"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.3:*:*:*:*:*:*:*","matchCriteriaId":"0102C4C0-1A7D-4AB7-9817-44E6B0DB761E"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.4:*:*:*:*:*:*:*","matchCriteriaId":"81DDF486-4185-48EE-869E-0AA6726C31F7"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.5:*:*:*:*:*:*:*","matchCriteriaId":"CF45A8E1-F6B1-42BD-9168-12062FA6EAEA"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.6:*:*:*:*:*:*:*","matchCriteriaId":"C5757B9B-2759-439A-9A6D-CCDD6C8C8940"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.7:*:*:*:*:*:*:*","matchCriteriaId":"FCD71268-EAA2-477B-8AC4-DE4853A262B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.8:*:*:*:*:*:*:*","matchCriteriaId":"529B2115-A191-4F3F-8F8C-A38B7C45463A"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:1.4:*:*:*:*:*:*:*","matchCriteriaId":"7E2D0508-C418-48CE-BF83-39F893688D1C"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk_business_edition:c.1.0-beta7:*:*:*:*:*:*:*","matchCriteriaId":"5BC80EBD-14D3-44A6-A06F-0549722E0EFA"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisk_business_edition:c.1.0-beta8:*:*:*:*:*:*:*","matchCriteriaId":"7859797F-E9AD-4429-BD2C-A24EC24A5D03"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisknow:1.0:*:*:*:*:*:*:*","matchCriteriaId":"CC6FE17C-3B08-4675-9F73-5DC0C2438BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisknow:beta_5:*:*:*:*:*:*:*","matchCriteriaId":"B12A09BE-1EE0-46D5-B3F0-E8847409A49A"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisknow:beta_6:*:*:*:*:*:*:*","matchCriteriaId":"7A5A734E-1DD3-4924-8AC1-97048FA3270F"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:asterisknow:beta_7:*:*:*:*:*:*:*","matchCriteriaId":"3AE2F09E-4B5A-4EDF-A48A-BCBBAA80156B"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:s800i:1.0:*:*:*:*:*:*:*","matchCriteriaId":"0C3A0A08-4107-4B8B-AE7E-DC23849A54DC"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:s800i:1.0.1:*:*:*:*:*:*:*","matchCriteriaId":"9320928D-D83C-4258-AF62-AB2D1F50D972"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:s800i:1.0.2:*:*:*:*:*:*:*","matchCriteriaId":"569084D1-977D-41FC-A444-0B3F5199DDD3"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:s800i:1.0.3:*:*:*:*:*:*:*","matchCriteriaId":"02D182FB-761C-4F08-A776-B613FAC55230"},{"vulnerable":true,"criteria":"cpe:2.3:a:asterisk:s800i:1.1.0:*:*:*:*:*:*:*","matchCriteriaId":"A7B5EDAB-61DD-4864-A159-39292D339DA2"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"1390","Ordinal":"1","Title":"CVE-2008-1390","CVE":"CVE-2008-1390","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"1390","Ordinal":"1","NoteData":"The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.","Type":"Description","Title":"CVE-2008-1390"},{"CveYear":"2008","CveId":"1390","Ordinal":"2","NoteData":"2008-03-24","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"1390","Ordinal":"3","NoteData":"2018-10-11","Type":"Other","Title":"Modified"}]}}}