PT-2022-18435 · Wwbn · Avideo

Published 2022-04-05 · Updated 2022-04-12 · CVE-2022-27463

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through 11.6

Description The issue is an open redirect vulnerability in the objects/login.json.php file, which allows attackers to redirect users from a crafted URL to the login page. This can be achieved by exploiting the vulnerability in the login.json.php file.

Recommendations For WWBN AVideo versions through 11.6, update to a version that includes the patch available on the master branch of the repository. As a temporary workaround, consider restricting access to the objects/login.json.php file to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-27463

GHSA-34HV-F45P-4QFQ

Affected Products

Avideo

References · 8

• https://github.com/WWBN/AVideo/commit/77e9aa6411ff4b97571eb82e587139ec05ff894c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-27463 · Security Note
• https://osv.dev/vulnerability/GHSA-34hv-f45p-4qfq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27463 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://avideo.tube · Note
• https://t.me/cibsecurity/40179 · Telegram Post
• https://t.me/cvenotify/28457 · Telegram Post