CVE-2024-3462
Authorization bypass in Ant Media Server
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users.
All versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.
Ant Media Server Community Edition en una configuración predeterminada es vulnerable a una autorización basada en encabezado HTTP inadecuada, lo que lleva a un posible uso de llamadas API no administrativas reservadas solo para usuarios autorizados. Se cree que todas las versiones hasta la 2.9.0 (probadas) y posiblemente las más nuevas son vulnerables ya que el proveedor no ha confirmado el lanzamiento de un parche.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-04-08 CVE Reserved
- 2024-05-13 CVE Published
- 2024-05-14 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-863: Incorrect Authorization
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://antmedia.io | Product | |
https://cert.pl/en/posts/2024/05/CVE-2024-3462 | Third Party Advisory | |
https://cert.pl/posts/2024/05/CVE-2024-3462 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Ant Media Search vendor "Ant Media" | Ant Media Server Community Edition Search vendor "Ant Media" for product "Ant Media Server Community Edition" | <= 2.9.0 Search vendor "Ant Media" for product "Ant Media Server Community Edition" and version " <= 2.9.0" | en |
Affected
|