PT-2022-21460 · Wwbn · Avideo

Claudio Bozzato · Published 2022-08-22 · Updated 2022-08-24 · CVE-2022-32778

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 11.6 and dev master commit 3f7c0364

Description An information disclosure issue exists in the cookie functionality. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, allowing it to be leaked over non-HTTPS connections. This could enable an attacker to steal the session cookie via crafted HTTP requests. The pass cookie, which contains the hashed password, can be leaked via JavaScript.

Recommendations For WWBN AVideo version 11.6, consider setting the HttpOnly and secure flags for the session and pass cookies to prevent them from being accessed via JavaScript and leaked over non-HTTPS connections. For WWBN AVideo dev master commit 3f7c0364, consider setting the HttpOnly and secure flags for the session and pass cookies to prevent them from being accessed via JavaScript and leaked over non-HTTPS connections. As a temporary workaround, consider restricting access to the pass cookie and session cookie until a patch is available.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-32778

Affected Products

Avideo

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-32778 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32778 · Vendor Advisory
• https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql · Note
• https://t.me/cibsecurity/48539 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1542 · Note