PT-2023-23017 · Avideo · Avideo

Gonzxph · Publicado 2023-05-01 · Atualizado 2023-05-17 · CVE-2023-30860

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 12.4

Description The issue arises from the failure to properly sanitize malicious characters when creating a Meeting Room in AVideo, allowing an attacker to insert malicious scripts. This can lead to cookie hijacking and takeover of any accounts, including those of administrators, as any user can see the meeting room created by the attacker.

Recommendations For versions prior to 12.4, update to version 12.4 to resolve the issue. As a temporary workaround, consider restricting access to the Meeting Schedule feature until the update is applied. Additionally, avoid using the "Meet topic" field for any potentially malicious input until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-30860

GHSA-XR9H-P2RC-RPQM

Produtos afetados

Avideo

Referências · 9

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-xr9h-p2rc-rpqm · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30860.json · Exploit
• 🔥 https://youtu.be/Nke0Bmv5F-o · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-30860 · Nota de Segurança
• https://t.me/cibsecurity/63455 · Publicação no Telegram
• https://t.me/cvenotify/50653 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-xr9h-p2rc-rpqm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-30860 · Aviso do Fabricante