GitHub Advisoryadvisory · Maven

GHSA-g95v-3pj6-j433 Ant Media Server does not properly authorize non-administrative API calls

LOW Published 2024-05-14 Modified 2024-11-07 Official page ↗
Aliases
CVE-2024-3462
Ecosystem
Maven
Packages
io.antmedia:ant-media-server
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-302
Reviewed
2024-05-14

Affected packages

• Maven io.antmedia:ant-media-server: <= 2.9.0 (no fix yet)

Description

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users.  All versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.

Related

Alias · CVE (1)

  • CVE-2024-3462 Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a… vulnerability

Weakness · CWE (1)

  • CWE-302 Authentication Bypass by Assumed-Immutable Data weakness

References