SSRF in Haivision Aviwest Manager
CVE-2024-1965
Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.004 (26.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 26th percentile — 26.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Haivision Aviwest Manager — versions all versions
- Haivision Aviwest Streamhub — versions all versions
- Haivision Maanager
- Haivision Streamhub
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerab… (Third Party Advisory)
Frequently asked questions
- What is CVE-2024-1965?
- CVE-2024-1965 is a medium-severity vulnerability in Haivision Aviwest Manager, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2024-02-28.
- How severe is CVE-2024-1965?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2024-1965 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.