PT-2023-20024 · World Wide Broadcast Network · Avideo

Gonzxph · Publicado 2023-02-02 · Atualizado 2023-05-04 · CVE-2023-25313

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions World Wide Broadcast Network AVideo versions prior to 12.4

Description The issue allows attackers to execute arbitrary code via the video link field to the Embed a video link feature. An attacker could execute remote code on a system running wwbn/avideo by appending a command to the URL as a query string, for example, ?whoami, and then clicking Save. This can be done by going to the My Videos tab, clicking "Embed a video link", and then appending the malicious query string.

Recommendations For versions prior to 12.4, update to version 12.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Embed a video link" feature in the My Videos tab until the update is applied. Avoid using the video link field to execute arbitrary commands until the issue is resolved.

Exploit

Correção

OS Command Injection

XSS

Enumeração de Fraquezas

CWE-78

CWE-79

Identificadores relacionados

CVE-2023-25313

GHSA-PGVH-P3G4-86JW

GHSA-WJ6R-53F5-Q789

Produtos afetados

Avideo

Referências · 10

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-pgvh-p3g4-86jw · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/commit/236228f15a9a31be5a0e60f05dac043682e49a5e · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25313 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-30842 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-pgvh-p3g4-86jw · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wj6r-53f5-q789 · Aviso do Fabricante
• https://t.me/cvenotify/49814 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25313 · Aviso do Fabricante
• https://t.me/cibsecurity/62817 · Publicação no Telegram