CVE-2022-32770criticalCWE-79

CVE-2022-32770: critical vulnerability in WWBN AVideo

Published · Updated

Follow this CVE+ Monitor AVideo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.6epss 4.7%
In short

A vulnerability in AVideo 11.6 allows attackers to inject malicious JavaScript code through the footer alerts feature. If a user clicks a specially crafted link, the attacker's code runs in their browser and can steal data or perform actions on their behalf.

Technical detail

Cross-site scripting (XSS) vulnerability in the toast parameter of WWBN AVideo 11.6 and dev master (commit 3f7c0364) footer alerts functionality. The parameter is inserted into the DOM with insufficient sanitization, allowing authenticated users to be tricked into sending crafted HTTP requests that execute arbitrary JavaScript in the victim's browser context.

Summary generated and translated by AI from the official description.
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "toast" parameter which is inserted into the document with insufficient sanitization.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
WWBN · AVideo
Related CVEs — WWBN AVideo

In the same product, most dangerous first.

CVE-2022-30690CRITICALCVE-2022-30690EPSS 83.9%CVE-2022-30534CRITICALCVE-2022-30534EPSS 75.0%CVE-2022-30547CRITICALCVE-2022-30547EPSS 63.7%CVE-2022-32572CRITICALCVE-2022-32572EPSS 24.1%CVE-2026-33478CRITICALAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionEPSS 13.3%CVE-2023-32073HIGHAVideo command injection vulnerabilityEPSS 6.5%