Lucene search

K
githubGitHub Advisory DatabaseGHSA-WQCC-QF63-C2X4
HistoryJan 10, 2024 - 6:30 p.m.

WWBN AVideo Insufficient Entropy vulnerbaility

2024-01-1018:30:27
CWE-331
GitHub Advisory Database
github.com
8
wwbn avideo
insufficient entropy
salt generation
privilege escalation
http requests
system information
bruteforce
password recovery
software

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and bruteforce the salt offline, leading to forging a legitimate password recovery code for the admin user.

Affected configurations

Vulners
Node
wwbnavideoRange12.4
CPENameOperatorVersion
wwbn/avideole12.4

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%