CVE-2024-3462 Authorization bypass in Ant Media Server

2024-05-1308:19:13

CWE-863

CERT-PL

www.cve.org

ant media server

authorization bypass

cve-2024-3462

http header

vulnerability

non-administrative api

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.5%

JSON

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users.
All versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Ant Media Server Community Edition",
    "repo": "https://github.com/ant-media/Ant-Media-Server",
    "vendor": "Ant Media",
    "versions": [
      {
        "lessThanOrEqual": "2.9.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]