PT-2024-18457 · Haivision · Aviwest Steamhub+1

Konrad Kowal Karp · Published 2024-02-28 · Updated 2025-04-10 · CVE-2024-1965

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Haivision's Aviwest Manager and Aviwest Steamhub (affected versions not specified)

Description This issue allows an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users. The vulnerability could be exploited to gain unauthorized access to internal network information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-1965

Affected Products

Aviwest Manager

Aviwest Steamhub

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-1965 · Security Note
• https://twitter.com/CVEnew/status/1762847249204207843 · Twitter Post
• https://twitter.com/incibe_cert/status/1762817524360479154 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1762862689246654726 · Twitter Post
• https://t.me/cvenotify/118738 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products · Note