CVE-2024-1965: Server-Side Request Forgery Vulnerability in Haivision Products

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-28 · updated 2026-06-17
Weakness: CWE-918

Description

Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users.

Affected products

Haivision Maanager: all versions
Haivision Streamhub: all versions

References

https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products
https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-vulnerability-haivision-products

Get alerted when CVE-2024-1965 or the next vulnerability affects your stack