CVE-2024-3462 | THREATINT

Assigner	CERT-PL
Reserved	2024-04-08
Published	2024-05-13
Updated	2024-06-04

Description

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.

Problem types

CWE-863 Incorrect Authorization

Product status

Default status

unknown

Any version

affected

Credits

Maksym Brzęczek (efigo.pl) finder

References

https://antmedia.io/ product

https://cert.pl/en/posts/2024/05/CVE-2024-3462 third-party-advisory

https://cert.pl/posts/2024/05/CVE-2024-3462 third-party-advisory

cve.org CVE-2024-3462

nvd.nist.gov CVE-2024-3462

Download JSON