PT-2024-13804 · Wwbn · Avideo

Claudio Bozzato · Published 2024-01-10 · Updated 2024-01-17 · CVE-2023-49810

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WWBN AVideo dev master commit 15fed957fb

Description A login attempt restriction bypass issue exists in the checkLoginAttempts functionality. This can be triggered by a specially crafted HTTP request, leading to captcha bypass. An attacker can exploit this to brute force user credentials by sending a series of HTTP requests.

Recommendations For WWBN AVideo dev master commit 15fed957fb, as a temporary workaround, consider disabling the checkLoginAttempts functionality until a patch is available. Restrict access to the login functionality to minimize the risk of exploitation. Avoid using the login feature in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2023-49810

GHSA-V977-H4HM-RRFF

Affected Products

Avideo

References · 8

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1898 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49810 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49810 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v977-h4hm-rrff · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/15fed957fb64b4055158acfc449bd7974346edb5 · Note
• https://twitter.com/VulmonFeeds/status/1745135357308330490 · Twitter Post
• https://twitter.com/CVEnew/status/1745111412811219292 · Twitter Post