Asterisk exposes a flaw in its embedded web interface at the "/httpstatus" endpoint where values supplied via cookies and GET query parameters are written directly into the returned HTML page using the unsafe ast_str_append function. Because no sanitization or escaping is performed, an attacker can inject arbitrary HTML or JavaScript that will execute in the victim's browser when the page is viewed. This client‑side code execution can lead to session hijacking, credential theft, or further compromise of the web server, making it a classic XSS vulnerability. The impact is limited to the browser context of users who load the page; it does not provide direct remote code execution or access to the underlying Asterisk instance.

The affected product is Asterisk, the open source telephony toolkit. Vendor Sangoma distributes both the community edition and certified releases. All versions prior to 20.7‑cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2 contain the flaw. Those fixed releases contain sanitization logic to prevent the injection of uncontrolled content into the /httpstatus page.

The CVSS score of 3.5 indicates low overall severity, and the EPSS score of less than 1 % suggests that exploitation attempts are currently rare. The vulnerability is not listed in the CISA Known Exploited Vulnerability catalog. Attackers would need to send a crafted URL or cookie to a user who accesses the /httpstatus page, which is typically not exposed publicly. If the embedded web server is reachable over the internet, the risk rises because any authenticated or unauthenticated user could be forced to load the page and thus be subject to XSS. The primary resolution therefore is to update the software so that input values are properly escaped before rendering.