PT-2024-26036 · Ant Media Server · Ant Media Server Community Edition

Maksym Brzäczkowi + 1 · Published 2024-05-13 · Updated 2024-11-07 · CVE-2024-3462

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ant Media Server Community Edition versions prior to 2.9.0

Description The issue is related to an improper HTTP header based authorization, allowing the use of non-administrative API calls reserved for authorized users.

Recommendations For versions prior to 2.9.0, consider restricting access to API endpoints until a patch is available. As a temporary workaround, review and limit the use of HTTP headers to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-302

Related Identifiers

CVE-2024-3462

GHSA-G95V-3PJ6-J433

Affected Products

Ant Media Server Community Edition

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-3462 · Security Note
• https://osv.dev/vulnerability/GHSA-g95v-3pj6-j433 · Vendor Advisory
• https://github.com/ant-media/Ant-Media-Server · Note
• https://twitter.com/CVEnew/status/1789938187282080184 · Twitter Post
• https://t.me/cvenotify/100960 · Telegram Post
• https://antmedia.io · Note
• https://cert.pl/posts/2024/05/CVE-2024-3462 · Note
• https://cert.pl/en/posts/2024/05/CVE-2024-3462 · Note