CVE-2024-44730

Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arbitrary sender name.

Score

CVSS 3.1 9.1 Critical

Status

Deferred - cve@mitre.org

Published

2024-10-11

Last modified

2024-10-16

Weaknesses

CWE-924

Affected products

• Mirotalk P2p (Mirotalk)

References

• https://aware7.com/de/blog/schwachstellen-in-videokonferenzsystemen/
• https://github.com/miroslavpejic85
• https://github.com/miroslavpejic85/mirotalk
• https://github.com/miroslavpejic85/mirotalksfu/blob/main/SECURITY.md