CVE-2023-32073 - AVideo command injection vulnerability

Back Back to CVE browser

HIGH

AVideo command injection vulnerability

Published May 12, 2023

8.8

HIGH

CVSS 3.1

EPSS 6.46%

Description

WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.

Affected products

Vendor WWBN Product AVideo Default
n/a
- Version
  <= 12.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

WWBN

AVideo

n/a

Version	Status	Constraints
<= 12.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1451
Advisory
https://github.com/WWBN/AVideo/commit/1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3
x_refsource_MISCPatch
https://github.com/WWBN/AVideo/security/advisories/GHSA-2mhh-27v7-3vcx
x_refsource_CONFIRMExploitVendor Advisory
https://github.com/advisories/GHSA-2mhh-27v7-3vcx
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-32073

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1451		Advisory
https://github.com/WWBN/AVideo/commit/1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3		x_refsource_MISCPatch
https://github.com/WWBN/AVideo/security/advisories/GHSA-2mhh-27v7-3vcx		x_refsource_CONFIRMExploitVendor Advisory
https://github.com/advisories/GHSA-2mhh-27v7-3vcx		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-32073