PT-2022-21459 · Wwbn · Wwbn Avideo

Claudio Bozzato · Published 2022-08-22 · Updated 2022-08-24 · CVE-2022-32777

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 11.6

Description An information disclosure issue exists in the cookie functionality. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, allowing it to be leaked over non-HTTPS connections. This could enable an attacker to steal the session cookie via crafted HTTP requests.

Recommendations For WWBN AVideo version 11.6, consider setting the HttpOnly and secure flags for the session cookie to prevent it from being accessed via JavaScript and leaked over non-HTTPS connections. As a temporary workaround, restrict access to sensitive information that could be compromised by a stolen session cookie until a patch is available.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-32777

Affected Products

Wwbn Avideo

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-32777 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32777 · Vendor Advisory
• https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1542 · Note
• https://t.me/cibsecurity/48553 · Telegram Post