CVE-2022-30605: high-severity vulnerability in WWBN AVideo
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
AVideo 11.6 has a flaw in how it manages user sessions that allows an attacker to trick a logged-in user into sending a specially crafted request, which then gives the attacker higher privileges in the system.
A session fixation or manipulation vulnerability in WWBN AVideo 11.6 (and dev master commit 3f7c0364) enables privilege escalation via crafted HTTP requests. The attack vector requires user interaction (social engineering or CSRF) to trigger privilege elevation. An unauthenticated attacker can exploit this to gain administrative or elevated access.
In the same product, most dangerous first.