PT-2022-21452 · Wwbn · Avideo

Claudio Bozzato · Published 2022-08-22 · Updated 2023-06-30 · CVE-2022-32770

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 11.6 and dev master commit 3f7c0364

Description A cross-site scripting (xss) vulnerability exists in the footer alerts functionality. This issue allows for arbitrary Javascript execution through a specially-crafted HTTP request. An attacker can exploit this by getting an authenticated user to send a crafted HTTP request. The vulnerability arises from the toast parameter, which is inserted into the document with insufficient sanitization.

Recommendations For WWBN AVideo version 11.6, consider disabling the footer alerts functionality until a patch is available. For WWBN AVideo dev master commit 3f7c0364, restrict the use of the toast parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the toast parameter in the affected functionality until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-32770

Affected Products

Avideo

References · 6

• https://osv.dev/vulnerability/CVE-2022-32770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32770 · Security Note
• https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql · Note
• https://t.me/defcon_news/115443 · Telegram Post
• https://t.me/cibsecurity/48540 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1538 · Note