An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesnt actually exist during a query_logger Admin API request, because of a typo in the JSON validation.
Weakness
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Janus | Meetecho | * | 0.9.1 (including) |
| Janus | Ubuntu | bionic | * |
| Janus | Ubuntu | eoan | * |
| Janus | Ubuntu | esm-apps/bionic | * |
| Janus | Ubuntu | esm-apps/focal | * |
| Janus | Ubuntu | esm-apps/jammy | * |
| Janus | Ubuntu | focal | * |
| Janus | Ubuntu | groovy | * |
| Janus | Ubuntu | hirsute | * |
| Janus | Ubuntu | impish | * |
| Janus | Ubuntu | jammy | * |
| Janus | Ubuntu | kinetic | * |
| Janus | Ubuntu | trusty | * |
| Janus | Ubuntu | upstream | * |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/159.html
- https://cwe.mitre.org/data/definitions/177.html
- https://cwe.mitre.org/data/definitions/48.html
- https://cwe.mitre.org/data/definitions/641.html