PT-2022-21454 · Wwbn · Avideo

Claudio Bozzato · Published 2022-08-22 · Updated 2022-08-24 · CVE-2022-32772

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 11.6 and dev master commit 3f7c0364

Description A cross-site scripting issue exists in the footer alerts functionality. This is caused by a specially-crafted HTTP request that can lead to arbitrary Javascript execution. An attacker can exploit this by getting an authenticated user to send a crafted HTTP request. The issue arises from the msg parameter, which is inserted into the document with insufficient sanitization.

Recommendations For WWBN AVideo version 11.6, consider disabling the footer alerts functionality until a patch is available. For WWBN AVideo dev master commit 3f7c0364, restrict the use of the msg parameter in the footer alerts functionality to minimize the risk of exploitation. As a temporary workaround, avoid using the msg parameter in the affected functionality until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-32772

Affected Products

Avideo

References · 5

• https://osv.dev/vulnerability/CVE-2022-32772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32772 · Security Note
• https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql · Note
• https://t.me/cibsecurity/48537 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1538 · Note