CVE-2024-29026CWE-352CWE-697

Owncast cross origin request

High · published March 20, 2024

CVSS v3.1
8.2
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit 9215d9ba0f29d62201d3feea9e77dcd274581624 fixes this issue.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.3th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-697 · Incorrect Comparison
Published
2024-03-20T21:55Z
EPSS history
Timeline
  • 20 MAR 21:55Z
    Owncast cross origin request
    cvelistv5