CVE-2023-32073highCWE-77

CVE-2023-32073: high-severity vulnerability in WWBN AVideo

AVideo command injection vulnerability

Published · Updated

Follow this CVE+ Monitor AVideo+ Monitor wwbn/avideo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 6.5%
In short

AVideo has a command injection flaw in its CloneSite plugin that lets attackers run arbitrary code on the server. This bypasses a previous security fix and affects versions 12.4 and earlier.

Technical detail

A command injection vulnerability exists in plugin/CloneSite/cloneClient.json.php that allows unauthenticated remote code execution through improperly sanitized input passed to system commands. The vulnerability is a bypass of CVE-2023-30854's mitigation; successful exploitation requires the CloneSite plugin to be enabled, granting complete server compromise.

Summary generated and translated by AI from the official description.
WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
WWBN · AVideo
Related CVEs — WWBN AVideo

In the same product, most dangerous first.

CVE-2022-30690CRITICALCVE-2022-30690EPSS 83.9%CVE-2022-30534CRITICALCVE-2022-30534EPSS 75.0%CVE-2022-30547CRITICALCVE-2022-30547EPSS 63.7%CVE-2022-32572CRITICALCVE-2022-32572EPSS 24.1%CVE-2026-33478CRITICALAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionEPSS 13.3%CVE-2023-30854HIGHWWBN AVideo vulnerable to OS Command InjectionEPSS 5.2%