CVE-2022-32771criticalCWE-79

CVE-2022-32771: critical vulnerability in WWBN AVideo

Published · Updated

Follow this CVE+ Monitor AVideo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.6epss 4.5%
In short

A flaw in WWBN AVideo's footer alerts allows attackers to inject malicious JavaScript code that runs in users' browsers. An attacker can trick a logged-in user into clicking a link, causing harmful scripts to execute and potentially steal their data or account access.

Technical detail

Cross-site scripting (XSS) vulnerability in the footer alerts functionality of WWBN AVideo 11.6 and dev master, where the 'success' parameter is inserted into the DOM without proper sanitization. Attack requires social engineering to get an authenticated user to send a crafted HTTP request; successful exploitation results in arbitrary JavaScript execution in the victim's browser context.

Summary generated and translated by AI from the official description.
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "success" parameter which is inserted into the document with insufficient sanitization.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
WWBN · AVideo
Related CVEs — WWBN AVideo

In the same product, most dangerous first.

CVE-2022-30690CRITICALCVE-2022-30690EPSS 83.9%CVE-2022-30534CRITICALCVE-2022-30534EPSS 75.0%CVE-2022-30547CRITICALCVE-2022-30547EPSS 63.7%CVE-2022-32572CRITICALCVE-2022-32572EPSS 24.1%CVE-2026-33478CRITICALAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionEPSS 13.3%CVE-2023-32073HIGHAVideo command injection vulnerabilityEPSS 6.5%