CVE-2022-32778: high-severity vulnerability in WWBN AVideo
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Cookies in WWBN AVideo 11.6 are missing security flags, allowing attackers to steal session and password information through JavaScript or unencrypted connections. This could let someone hijack user accounts or access protected content.
The session and pass cookies lack the HttpOnly flag, making them accessible to JavaScript-based attacks (XSS). The session cookie additionally lacks the Secure flag, enabling interception over non-HTTPS channels. An attacker can exploit these missing protections to exfiltrate authentication tokens and password hashes.
In the same product, most dangerous first.