CVE Feed

    Dashboard / CVE / CVE-2023-34105

    CVE-2023-34105

    SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's `api-server` server is vulnerable to a drive-by command injection. An attacker may send a request to the `/api/v1/snapshots` endpoint containing any commands to be executed as part of the body of the POST request. This issue may lead to Remote Code Execution (RCE). Versions 5.0.157, 5.0-b1, and 6.0.48 contain a fix.

    Published:Jun 12, 2023
    Last Modified:Jan 3, 2025
    EPS:Jun 12, 2023
    EPSS Score:0.8285
    CVSS Score:7.5

    Affected Products

    Vendor
    Ossrs
    Product
    Simple Realtime Server

    Exploits

    https://github.com/ossrs/srs/security/advisories/GHSA-vpr5-779c-cx62https://github.com/ossrs/srs/security/advisories/GHSA-vpr5-779c-cx62

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High