PT-2022-21711 · Wwbn · Avideo

Claudio Bozzato · Published 2022-08-22 · Updated 2022-08-24 · CVE-2022-33149

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WWBN AVideo version 11.6 WWBN AVideo dev master commit 3f7c0364

Description A sql injection vulnerability exists in the ObjectYPT functionality, allowing an attacker to inject SQL by manipulating the url parameter. This issue is present in the CloneSite plugin. An attacker can send a specially-crafted HTTP request to trigger this vulnerability.

Recommendations For WWBN AVideo version 11.6, consider disabling the CloneSite plugin until a patch is available. For WWBN AVideo dev master commit 3f7c0364, restrict access to the ObjectYPT functionality to minimize the risk of exploitation. As a temporary workaround, avoid using the url parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-33149

Affected Products

Avideo

References · 6

• https://osv.dev/vulnerability/CVE-2022-33149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33149 · Security Note
• https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1551 · Note
• https://t.me/cibsecurity/48552 · Telegram Post
• https://t.me/cvenotify/35067 · Telegram Post