CVE-2024-44730

State: Published
Severity: 9.1 Critical
Published: Oct 11, 2024
Updated: Oct 16, 2024
Reserved: Aug 21, 2024

Description

Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arbitrary sender name.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/miroslavpejic85/mirotalk
https://github.com/miroslavpejic85
https://aware7.com/de/blog/schwachstellen-in-videokonferenzsystemen/
https://github.com/miroslavpejic85/mirotalksfu/blob/main/SECURITY.md

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.