{"id":"CVE-2024-3462","aliases":["EUVD-2024-1624","GHSA-g95v-3pj6-j433"],"status":"published","title":"Authorization bypass in Ant Media Server","description":"Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. \nAll versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00479,"percentile":0.41653,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-302"],"published":"2024-05-13T08:19:13Z","modified":"2026-10-28T02:31:03Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.antmedia:ant-media-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.9.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.antmedia:ant-media-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.9.0"}]}],"versions":["1.2.0","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5.1","1.3.6.1","1.3.6.2","1.4.0","1.4.1","1.5.0","1.5.1","1.5.1.1","1.5.2","1.6.0","1.6.1","1.6.2","1.7.0","1.7.1","1.7.2","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.1.0","2.2.0","2.2.1","2.3.0","2.3.1","2.3.2","2.3.3","2.3.3.1","2.4.0","2.4.0.2","2.4.1","2.4.2","2.4.2.1","2.4.3","2.5.0","2.5.1","2.5.2","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0"]}],"products":[{"vendor":"ant media","product":"ant media server community edition"}],"references":[{"url":"https://antmedia.io/","tags":["product","x_transferred","web"]},{"url":"https://cert.pl/en/posts/2024/05/CVE-2024-3462","tags":["third-party-advisory","x_transferred","advisory","web"]},{"url":"https://cert.pl/posts/2024/05/CVE-2024-3462","tags":["third-party-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3462","tags":["advisory"]},{"url":"https://antmedia.io","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g95v-3pj6-j433"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3462.json","tags":["advisory"]},{"url":"https://github.com/ant-media/Ant-Media-Server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-3462","title":"Authorization bypass in Ant Media Server","description":"Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. \nAll versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.","status":"published","published":"2024-05-13T08:19:13.882Z","modified":"2024-11-07T15:16:53.084Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-302"],"updated_at":"2026-11-02T14:34:10.613319Z"}],"euvd":[{"id":"EUVD-2024-1624","description":"Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. \nAll versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.","status":"published","published":"2024-05-13T08:19:13Z","modified":"2024-11-07T15:16:53Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:08.721426Z"}],"ghsa":[{"id":"GHSA-g95v-3pj6-j433","title":"Ant Media Server does not properly authorize non-administrative API calls","description":"Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. \nAll versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.","status":"published","published":"2024-05-14T18:30:52Z","modified":"2024-11-07T19:19:15Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-302"],"updated_at":"2026-11-02T14:38:16.477822Z"}],"nvd":[{"id":"CVE-2024-3462","description":"Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. \nAll versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.","status":"published","published":"2024-05-14T15:41:14.04Z","modified":"2026-06-17T07:44:18.897Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-302"],"updated_at":"2026-11-02T14:09:58.124007Z"}],"osv":[{"id":"CVE-2024-3462","title":"Authorization bypass in Ant Media Server","description":"Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. \nAll versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.","status":"published","published":"2024-05-13T08:19:13.882Z","modified":"2026-10-28T02:31:03.48961365Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-302"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-g95v-3pj6-j433","title":"Ant Media Server does not properly authorize non-administrative API calls","description":"Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. \nAll versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.","status":"published","published":"2024-05-14T18:30:52Z","modified":"2024-11-07T19:22:23.349872Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-302"],"updated_at":"2026-11-02T15:46:47.472172Z"}]}}