PT-2024-21918 · Unknown · Zlmediakit

Published 2024-04-07 · Updated 2024-08-22 · CVE-2024-27488

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZLMediaKit versions 1.0 through 8.0

Description The issue allows remote attackers to escalate privileges and obtain sensitive information due to an Incorrect Access Control vulnerability. The application system enables the http API interface by default and uses the secret parameter method to authenticate the http restful API interface, but the secret is hardcoded by default.

Recommendations For ZLMediaKit versions 1.0 through 8.0, consider disabling the default http API interface or changing the hardcoded secret parameter to a unique and secure value until a patch is available. Restrict access to the http restful API interface to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-259

Related Identifiers

CVE-2024-27488

Affected Products

Zlmediakit

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-27488 · Security Note
• https://gist.github.com/tr4pmaker/44442d6f068458175213f4ba71da1312 · Note
• https://t.me/cvenotify/91768 · Telegram Post
• https://t.me/cvenotify/76018 · Telegram Post
• https://twitter.com/CVEnew/status/1777219949351858312 · Twitter Post