CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3462 – Authorization bypass in Ant Media Server
https://notcve.org/view.php?id=CVE-2024-3462
Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch. Ant Media Server Community Edition en una configuración predeterminada es vulnerable a una autorización basada en encabezado HTTP inadecuada, lo que lleva a un posible uso de llamadas API no administrativas reservadas solo para usuarios autorizados. Se cree que todas las versiones hasta la 2.9.0 (probadas) y posiblemente las más nuevas son vulnerables ya que el proveedor no ha confirmado el lanzamiento de un parche. • https://antmedia.io https://cert.pl/en/posts/2024/05/CVE-2024-3462 https://cert.pl/posts/2024/05/CVE-2024-3462 • CWE-302: Authentication Bypass by Assumed-Immutable Data CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32656 – Ant Media Server vulnerable to local privilege escalation
https://notcve.org/view.php?id=CVE-2024-32656
Ant Media Server is live streaming engine software. A local privilege escalation vulnerability in present in versions 2.6.0 through 2.8.2 allows any unprivileged operating system user account to escalate privileges to the root user account on the system. This vulnerability arises from Ant Media Server running with Java Management Extensions (JMX) enabled and authentication disabled on localhost on port 5599/TCP. This vulnerability is nearly identical to the local privilege escalation vulnerability CVE-2023-26269 identified in Apache James. Any unprivileged operating system user can connect to the JMX service running on port 5599/TCP on localhost and leverage the MLet Bean within JMX to load a remote MBean from an attacker-controlled server. • https://github.com/ant-media/Ant-Media-Server/commit/9cb38500729e0ff302da0290b9cfe1ec4dd6c764 https://github.com/ant-media/Ant-Media-Server/security/advisories/GHSA-qwhw-hh9j-54f5 • CWE-862: Missing Authorization •