SSRF in Haivision Aviwest Manager
CVE-2024-1965
Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.004 (27.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Haivision Aviwest Manager — versions all versions
- Haivision Aviwest Streamhub — versions all versions
- Haivision Maanager
- Haivision Streamhub
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve-coordination@incibe.es (Third Party Advisory)
Frequently asked questions
- What is CVE-2024-1965?
- CVE-2024-1965 is a medium-severity vulnerability in Haivision Aviwest Manager, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2024-02-28.
- How severe is CVE-2024-1965?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2024-1965 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.