What is GHSA-2gx6-qrpp-c4p3?

GHSA-2gx6-qrpp-c4p3 is a security advisory published by GitHub Security Advisories with High severity. Ant-Media-Server vulnerable to Improper Output Neutralization for Logs

Which CVE IDs does GHSA-2gx6-qrpp-c4p3 cover?

GHSA-2gx6-qrpp-c4p3 covers the following CVE IDs: CVE-2024-35371. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2gx6-qrpp-c4p3?

GHSA-2gx6-qrpp-c4p3 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-2gx6-qrpp-c4p3?

GHSA-2gx6-qrpp-c4p3 affects 1 product, including: maven/io.antmedia:ant-media-server:\u003c 2.9.0.

GHSA-2gx6-qrpp-c4p3HighCVSS 7.5

Ant-Media-Server vulnerable to Improper Output Neutralization for Logs

Vendor

GitHub Security Advisories

Published

November 29, 2024

Last Modified

December 2, 2024

🔗 CVE IDs covered (1)

CVE-2024-35371 →

📋 Description

Ant-Media-Server v2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without restrictions.

🎯 Affected products1

maven/io.antmedia:ant-media-server:< 2.9.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-35371
https://github.com/ant-media/ant-media-server/commit/4d4763bd4fd06e515c19544e5170ca0f34c9ce45
https://gist.github.com/1047524396/4eb17867f2e375f4824274c5e7b4d384
https://github.com/ant-media/Ant-Media-Server/blob/ams-v2.8.2/src/main/java/io/antmedia/rest/RestServiceBase.java#L356
https://github.com/advisories/GHSA-2gx6-qrpp-c4p3