CVE-2023-30854highCWE-78

CVE-2023-30854: high-severity vulnerability in WWBN AVideo

WWBN AVideo vulnerable to OS Command Injection

Published · Updated

Follow this CVE+ Monitor AVideo+ Monitor wwbn/avideo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 5.2%
In short

AVideo, a video platform software, has a flaw where logged-in users can run harmful commands on the server by exploiting a specific webpage feature. This allows attackers to take full control of the affected system.

Technical detail

An authenticated OS Command Injection vulnerability exists in the `/plugin/CloneSite/cloneClient.json.php` endpoint, allowing authenticated users to inject arbitrary OS commands that execute with server privileges. The vulnerability enables Remote Code Execution (RCE) with no additional preconditions beyond valid authentication. Fixed in version 12.4.

Summary generated and translated by AI from the official description.
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
WWBN · AVideo
Related CVEs — WWBN AVideo

In the same product, most dangerous first.

CVE-2022-30690CRITICALCVE-2022-30690EPSS 83.9%CVE-2022-30534CRITICALCVE-2022-30534EPSS 75.0%CVE-2022-30547CRITICALCVE-2022-30547EPSS 63.7%CVE-2022-32572CRITICALCVE-2022-32572EPSS 24.1%CVE-2026-33478CRITICALAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionEPSS 13.3%CVE-2023-32073HIGHAVideo command injection vulnerabilityEPSS 6.5%