Paper/Archive/CVE-2022-32771

CVE-2022-32771

WWBN AVideo — A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.

EPSS 5%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (CNA)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 91.5.915 × 2018.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "success" parameter which is inserted into the document with insufficient sanitization.

Affected

ProductAffectedFixed inSource

AVideo11.6–CNA

AVideodev master commit 3f7c0364–CNA

Scores by source

talos (CNA)9.6CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql reftalosintelligence.com/vulnerability_reports/TALOS-2022-1538