AVideo < 20.1 System Path Disclosure via Public API
28Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 6.9epss 0.8%
from disclosure to weapon2 days
Published on NVDDec 17
metasploit+2d
exploitation probability
0.8%top 48% of all CVEs
observed exploitation
nono source reports it
AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
World Wide Broadcast Network · AVideo