PT-2024-13634 · Wwbn · Avideo

Claudio Bozzato · Published 2024-01-10 · Updated 2024-01-17 · CVE-2023-48730

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WWBN AVideo dev master commit 15fed957fb

Description A cross-site scripting (xss) issue exists in the navbarMenuAndLogo.php user name functionality. This allows an attacker to execute arbitrary Javascript code through a specially crafted HTTP request. An attacker can exploit this by getting a user to visit a malicious webpage.

Recommendations For WWBN AVideo dev master commit 15fed957fb, consider disabling the user name functionality in navbarMenuAndLogo.php until a patch is available to prevent arbitrary Javascript execution. Restrict access to this functionality to minimize the risk of exploitation. Avoid using the user name field in the navbarMenuAndLogo.php file until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-48730

Affected Products

Avideo

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-48730 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48730 · Vendor Advisory
• https://twitter.com/CVEnew/status/1745111405668278714 · Twitter Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1882 · Note