CVE-2024-29882

MEDIO 6.1CVE-2024-29882 · Published 28/03/2024 · updated 17/06/2026

In breve

CVE-2024-29882 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda simple realtime server (ossrs).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 65.4% delle vulnerabilità.
Correzione: aggiornare a 6.0.121, 5.0.210 o successiva.

Package	Affected versions	Patched versions
simple realtime server ossrs	`≥ 6.0.0, < 6.0.121< 5.0.210`	`6.0.1215.0.210`

Description

SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS ( Cross-Site Scripting). This vulnerability is fixed in 5.0.210 and 6.0.121.

References

ossrs/srs commit 244ce7b · Patch
ossrs/srs security advisory · Exploit

Altre vulnerabilità di simple realtime server

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free