CVE-2025-34442: fallo de gravedad media en World Wide Broadcast Network AVideo
AVideo < 20.1 System Path Disclosure via Public API
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 6.9epss 0.9%
de la publicación al arma2 días
Publicada en NVD17 dic
metasploit+2d
AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
World Wide Broadcast Network · AVideoCVEs relacionadas — World Wide Broadcast Network AVideo
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-34433CRITICALAVideo < 20.1 Unauthenticated RCE via Predictable Installation SaltEPSS 1.5%CVE-2025-34441MEDIUMAVideo < 20.1 User Information Disclosure via Public APIEPSS 0.9%CVE-2025-34434CRITICALAVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and DeletionEPSS 0.5%CVE-2025-34436HIGHAVideo < 20.1 IDOR Arbitrary File UploadEPSS 0.4%CVE-2025-34437HIGHAVideo < 20.1 IDOR Arbitrary Comment Image UploadEPSS 0.4%CVE-2025-34435HIGHAVideo < 20.1 IDOR Arbitrary File DeletionEPSS 0.3%