CVE-2024-29882 — HIGH (7.2)

Vulnerability Description

SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS ( Cross-Site Scripting). This vulnerability is fixed in 5.0.210 and 6.0.121.

CVSS Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Ossrs	Simple Realtime Server	< 5.0.210

Related Weaknesses (CWE)

CWE-79

References

https://github.com/ossrs/srs/commit/244ce7bc013a0b805274a65132a2980680ba6b9dPatch
https://github.com/ossrs/srs/security/advisories/GHSA-gv9r-qcjc-5hj7ExploitVendor Advisory
https://github.com/ossrs/srs/commit/244ce7bc013a0b805274a65132a2980680ba6b9dPatch
https://github.com/ossrs/srs/security/advisories/GHSA-gv9r-qcjc-5hj7ExploitVendor Advisory

FAQ

What is CVE-2024-29882?

CVE-2024-29882 is a vulnerability with a CVSS score of 7.2 (HIGH). SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callback function name which led to injecting malicious javascri...

How severe is CVE-2024-29882?

CVE-2024-29882 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-29882?

Check the references section above for vendor advisories and patch information. Affected products include: Ossrs Simple Realtime Server.