GHSA-8m5f-2xvp-2c8w

ghsaUSosv

WWBN AVideo recovery notification bypass vulnerability

view advisory published 2024-01-10Licence: CC-BY-4.0

A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to silently create a recovery pass code for any user.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-50172US	—	0.83% (57th)	—	2024-01-10
A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTT…

references

External citations — patches, advisories, analysis.

https://github.com/WWBN/AVideoPACKAGE
https://github.com/WWBN/AVideo/commit/15fed957fb64b4055158acfc449bd7974346edb5WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-50172ADVISORY
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1897WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan