Ant Media Server does not properly authorize non-administrative API calls

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 tested and possibly newer ones are believed to be...

CVE-2024-3462

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 tested and possibly newer ones are believed to be...

Ant Media Server 安全漏洞

Ant Media Server is a real-time streaming engine software from Ant Media open source. It provides adaptive ultra-low latency streaming using WebRTC technology with a latency of approximately 0.5 seconds. A security vulnerability exists in Ant Media Server Community Edition prior to version 2.9.0...

CVE-2024-3462 Authorization bypass in Ant Media Server

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 tested and possibly newer ones are believed to be...

CVE-2024-3462 Authorization bypass in Ant Media Server

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 tested and possibly newer ones are believed to be...

CVE-2024-3462 Authorization bypass in Ant Media Server

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 tested and possibly newer ones are believed to be...

PT-2024-26036 · Ant Media Server · Ant Media Server Community Edition

Name of the Vulnerable Software and Affected Versions: Ant Media Server Community Edition versions prior to 2.9.0 Description: The issue is related to an improper HTTP header based authorization, allowing the use of non-administrative API calls reserved for authorized users. Recommendations: For...

RHEL 5 : ant (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ant: insecure temporary file CVE-2020-11979 - Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the...

RHEL 6 : ant (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ant: insecure temporary file CVE-2020-11979 - Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the...

RHEL 7 : ant (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ant: insecure temporary file CVE-2020-11979 - When reading a specially crafted TAR archive an Apache Ant...

CVE-2024-26979

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-26979

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-26979

CVE-2024-26979 is rejected/not used; not an active vulnerability entry.

Privilege Escalation

Ant Media Server is vulnerable to Privilege Escalation. The vulnerability is caused by running Java Management Extensions JMX with authentication disabled on localhost on port 5599. This allows unprivileged users to connect locally and leverage MLet Bean within JMX to load a remote MBean from an...

CVE-2024-32656

Ant Media Server is live streaming engine software. A local privilege escalation vulnerability in present in versions 2.6.0 through 2.8.2 allows any unprivileged operating system user account to escalate privileges to the root user account on the system. This vulnerability arises from Ant Media...

CVE-2024-32656

CVE-2024-32656 affects Ant Media Server (versions 2.6.0–2.8.2). The issue arises because JMX is enabled and unauthenticated on localhost:5599/TCP, allowing an unprivileged user to exploit the MLet bean to load a remote MBean and execute code in the antmedia process, effectively escalating to root...

CVE-2024-32656 Ant Media Server vulnerable to local privilege escalation

Ant Media Server is live streaming engine software. A local privilege escalation vulnerability in present in versions 2.6.0 through 2.8.2 allows any unprivileged operating system user account to escalate privileges to the root user account on the system. This vulnerability arises from Ant Media...

CVE-2024-32656 Ant Media Server vulnerable to local privilege escalation

Ant Media Server is live streaming engine software. A local privilege escalation vulnerability in present in versions 2.6.0 through 2.8.2 allows any unprivileged operating system user account to escalate privileges to the root user account on the system. This vulnerability arises from Ant Media...

CVE-2024-32656 Ant Media Server vulnerable to local privilege escalation

Ant Media Server is live streaming engine software. A local privilege escalation vulnerability in present in versions 2.6.0 through 2.8.2 allows any unprivileged operating system user account to escalate privileges to the root user account on the system. This vulnerability arises from Ant Media...

io.antmedia.webrtc:ConferenceCall (>=2.6.1 <=2.8.2), io.antmedia.webrtc:StreamApp (>=2.6.0 <=2.8.2) potentially affected by CVE-2024-32656 via io.antmedia:ant-media-server (>=2.6.0 <=2.8.2)

io.antmedia:ant-media-server MAVEN version =2.6.0, =2.6.1, =2.6.0, =2.8.2 Source cves: CVE-2024-32656 Source advisory: OSV:GHSA-QWHW-HH9J-54F5...