Paper/Archive/CVE-2022-30547

CVE-2022-30547

WWBN AVideo — A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.

EPSS 64%public exploit CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (NVD, CNA agree)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 99.2.992 × 2019.8 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource

AVideo11.6–CNA

AVideodev master commit 3f7c0364–CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

talos (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql reftalosintelligence.com/vulnerability_reports/TALOS-2022-1547