PT-2024-15711 · Unknown · C21 Live Encoder/Live Mosaic

Konrad Kowal Karp · CVE-2024-0642 · Published 2024-01-17 · Updated 2024-01-24

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions C21 Live Encoder and Live Mosaic version 5.3

Description The issue is related to inadequate access control, allowing a remote attacker to access the application as an administrator user due to lack of proper credential management. This can be done through the application endpoint.

Recommendations For version 5.3, consider restricting access to the application endpoint as a temporary workaround until a patch is available. Additionally, review and improve credential management to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-0642

Affected Products

C21 Live Encoder/Live Mosaic

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-0642 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0642 · Vendor Advisory
• https://t.me/cvenotify/67694 · Telegram Post
• https://twitter.com/CVEnew/status/1747617898934276268 · Twitter Post
• https://t.me/cvenotify/67740 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cires21-products · Note
• https://twitter.com/VulmonFeeds/status/1747644448337518716 · Twitter Post
• https://t.me/cvenotify/68573 · Telegram Post