title: Server-Side Request Forgery Vulnerability in Haivision Products
description: Server-Side Request Forgery vulnerability in Haivision's Aviwest Manager and Aviwest Steamhub. This vulnerability could allow an attacker to enumerate internal network configuration without the need for credentials. An attacker could compromise an internal server and retrieve requests sent by other users.
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
defaultStatus: unaffected
product: Aviwest Manager
vendor: Haivision
versions:
status: affected, version: all versions
}
{
defaultStatus: unaffected
product: Aviwest Streamhub
vendor: Haivision
versions:
status: affected, version: all versions
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL