Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass

guest · Aug 21, 2022

Vulnerability Spotlight
August 16, 2022

Cisco Talos recently discovered multiple vulnerabilities in the WWBN AVideo web application that could allow an attacker to carry out a wide range of malicious actions, including command injection and authentication bypass.

AVideo is an open-source web application that allows users to build a video streaming and sharing platform. Anyone who joins the community can host videos on-demand, launch a live stream or encode different video formats.
Click to expand...

TALOS-2022-1542 (CVE-2022-32777 - CVE-2022-32778), TALOS-2022-1549 (CVE-2022-32761) and TALOS-2022-1550 (CVE-2022-28710) are information disclosure vulnerabilities that are triggered if an adversary sends the targeted instance a specially crafted HTTP packet

Some of the most serious vulnerabilities discovered in this product are command execution issues. TALOS-2022-1546 (CVE-2022-30534) and TALOS-2022-1548 (CVE-2022-32572) are triggered in a similar way, and both lead to arbitrary command execution via command injection.
The app also contains three vulnerabilities that can be used for privilege escalation: TALOS-2022-1534 (CVE-2022-29468), TALOS-2022-1535 (CVE-2022-30605) and TALOS-2022-1545 (CVE-2022-32282).
Click to expand...

Talos tested and confirmed the following software is affected by these vulnerabilities: WWBN AVideo, version 11.6 and dev master commit 3f7c0364.
Click to expand...

Log in or Sign up

Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass

guest Guest

Log in or Sign up

Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass

guest Guest

Useful Searches