CVE-2022-30547: critical vulnerability in WWBN AVideo
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in AVideo's file extraction feature allows attackers to escape the intended directory and execute arbitrary commands on the server by sending a specially-crafted request. This is a critical vulnerability that gives attackers full control over the system.
A directory traversal vulnerability in the unzipDirectory function (CWE-22) allows unauthenticated remote attackers to traverse outside the intended extraction directory and achieve arbitrary command execution. The vulnerability is triggered via malicious HTTP requests and affects AVideo 11.6 and the dev master branch.
In the same product, most dangerous first.