CVE-2024-3462

2024-05-1415:41:14

CWE-863

CERT-PL

web.nvd.nist.gov

cve-2024-3462

http header authorization

non-administrative api

AI Score

6.7

Confidence

Low

EPSS

Percentile

15.5%

JSON

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users.
All versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Ant Media Server Community Edition",
    "repo": "https://github.com/ant-media/Ant-Media-Server",
    "vendor": "Ant Media",
    "versions": [
      {
        "lessThanOrEqual": "2.9.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]