{"id":"CVE-2024-1965","state":"PUBLISHED","title":"Server-Side Request Forgery Vulnerability in Haivision Products","description":"Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users.","publishedAt":"2024-02-28T12:19:55.059Z","updatedAt":"2024-08-02T17:08:02.850Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"INCIBE"},"assigner":"INCIBE","products":["Haivision  Aviwest Manager","Haivision  Aviwest Streamhub"],"affected":[{"vendor":"Haivision ","product":"Aviwest Manager","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Haivision ","product":"Aviwest Streamhub","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1965.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1965","state":"PUBLISHED","datePublished":"2024-02-28T12:19:55.059Z","dateUpdated":"2024-08-02T17:08:02.850Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2024-02-28T09:34:48.923Z"},"containers":{"cna":{"title":"Server-Side Request Forgery Vulnerability in Haivision Products","descriptions":[{"lang":"en","value":"Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users."}],"affected":[{"vendor":"Haivision ","product":"Aviwest Manager","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Haivision ","product":"Aviwest Streamhub","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2024-02-28T12:19:55.059Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Konrad Kowal Karp"}],"datePublic":"2024-02-28T11:00:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:56:22.638Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"haivision","product":"aviwest_manager","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"*","versionType":"custom"}],"cpes":["cpe:2.3:a:haivision:aviwest_manager:*:*:*:*:*:*:*:*"]},{"vendor":"haivision","product":"aviwest_streamhub","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"*","versionType":"custom"}],"cpes":["cpe:2.3:a:haivision:aviwest_streamhub:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-02T17:04:39.791306Z","id":"CVE-2024-1965","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-02T17:08:02.850Z"}}]}}}