PT-2022-21450 · Wwbn · Avideo

Claudio Bozzato · Published 2022-08-22 · Updated 2022-08-24 · CVE-2022-32768

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 11.6

Description Multiple authentication bypass issues exist in the objects id handling functionality. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP request to trigger this issue. This issue exists in the Live Schedules plugin, allowing an attacker to bypass authentication by guessing a sequential ID, allowing them to take over another user's streams.

Recommendations For version 11.6, consider disabling the Live Schedules plugin until a patch is available to prevent attackers from bypassing authentication and taking over user streams. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-32768

Affected Products

Avideo

References · 5

• https://osv.dev/vulnerability/CVE-2022-32768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32768 · Security Note
• https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql · Note
• https://t.me/cibsecurity/48541 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1536 · Note