CVE-2024-1965

Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products	Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:haivision:maanager::::::::
	cpe:2.3:a:haivision:streamhub::::::::

History

10 Apr 2025, 19:26

Type	Values Removed	Values Added
References	~~() https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products -~~	() https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products - Third Party Advisory
First Time		Haivision maanager Haivision streamhub Haivision
CPE		cpe:2.3:a:haivision:streamhub:::::::: cpe:2.3:a:haivision:maanager::::::::

Information

Published : 2024-02-28 13:15

Updated : 2025-04-10 19:26

NVD link : CVE-2024-1965

Mitre link : CVE-2024-1965

CVE.ORG link : CVE-2024-1965

JSON object : View

Products Affected

haivision

maanager
streamhub

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2024-1965", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-02-28T13:15:07.987", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}, {"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users."}, {"lang": "es", "value": "Vulnerabilidad de Server-Side Request Forgery en Aviwest Manager y Aviwest Steamhub de Haivision. Esta vulnerabilidad podr\u00eda permitir a un atacante enumerar la configuraci\u00f3n de red interna sin necesidad de credenciales. Un atacante podr\u00eda comprometer un servidor interno y recuperar solicitudes enviadas por otros usuarios."}], "lastModified": "2025-04-10T19:26:56.720", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:haivision:maanager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "919B2376-4F8F-4027-9E69-A9733D3B2930"}, {"criteria": "cpe:2.3:a:haivision:streamhub:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F7C8DC0-28A9-459B-9603-FD129EBBD050"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@incibe.es"}