The vulnerability is a reflected cross‑site scripting flaw in Asterisk’s phone provisioning HTTP error pages. An unauthenticated attacker can embed malicious JavaScript which runs in the context of a logged‑in AMI user’s browser, allowing the attacker to read the AMI session cookie from the page and impersonate the user for AMI operations.

Affected are Asterisk and Certified Asterisk releases earlier than 20.20.1, 21.12.3, 22.10.1, 23.4.1 and before Certified 20.7‑cert11 and 22.8‑cert3. The components required to be enabled are the Asterisk HTTP web server, the AMI interface, and AMI over HTTP. All of these are disabled by default and the web server normally binds to 127.0.0.1 unless an administrator explicitly enables it.

The CVSS score of 2.3 denotes low severity. The exploitation requires direct connectivity to the Asterisk HTTP server, which by default listens only on localhost, and a social‑engineering element – the victim must click a malicious link. Because the attack is not automated, the EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog. Consequently the risk remains low for correctly configured installations but may rise if the HTTP server or AMI is exposed to untrusted networks.