One Article Review
| Source |  CISCO Talos |
|---|---|
| Identifiant | 6355594 |
| Date de publication | 2022-08-16 11:54:34 (vue: 2022-08-16 17:06:03) |
| Titre | Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass |
| Texte |  Claudio Bozzato of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered multiple vulnerabilities in the WWBN AVideo web application that could allow an attacker to carry out a wide range of malicious actions, including command injection and authentication bypass. AVideo is an open-source web application that allows users to build a video streaming and sharing platform. Anyone who joins the community can host videos on-demand, launch a live stream or encode different video formats. TALOS-2022-1542 (CVE-2022-32777 - CVE-2022-32778), TALOS-2022-1549 (CVE-2022-32761) and TALOS-2022-1550 (CVE-2022-28710) are information disclosure vulnerabilities that are triggered if an adversary sends the targeted instance a specially crafted HTTP packet. TALOS-2022-1550 and TALOS-2022-1549 could allow the adversary to read arbitrarily selected files, while TALOS-2022-1542 could allow them to steal the session cookie. Some of the most serious vulnerabilities discovered in this product are code injection issues. TALOS-2022-1546 (CVE-2022-30534), TALOS-2022-1551 (CVE-2022-33147 - CVE-2022-33149) and TALOS-2022-1548 (CVE-2022-32572) are triggered in a similar way, but instead could lead to arbitrary command execution. That could allow an attacker to gain access to an administrator's account: TALOS-2022-1537 (CVE-2022-26842) TALOS-2022-1538 (CVE-2022-32770 - CVE-2022-32772) TALOS-2022-1539 (CVE-2022-30690) TALOS-2022-1540 (CVE-2022-28712) The app also contains three privilege escalation vulnerabilities: TALOS-2022-1534 (CVE-2022-29468), TALOS-2022-1535 (CVE-2022-30605) and TALOS-2022-1545 (CVE-2022-32282). An attacker could exploit TALOS-2022-1545 to log in with only a hashed version of a user's password. TALOS-2022-1534 and TALOS-2022-1535 could be triggered if the attacker sends |
| Envoyé | Oui |
| Condensat | that avideo cisco some talos the 1534 1535 1537 1538 1539 1540 1542 1545 1546 1548 1549 1550 1551 2022 26842 28710 28712 29468 30534 30605 30690 32282 32572 32761 32770 32772 32777 32778 33147 33149 3f7c0364 59993 59998 60003 60006 60071 60072 60079 60080 60145 60153 60204 60205 60208 access account: talos actions additional adherence administrator adversary affected against allow allows also anyone app application arbitrarily arbitrary are attacker attempts authentication avideo blog bozzato build but bypass can carry center change cisco claudio code command commit community confirmed contains cookie could crafted current cve demand detect dev different disclose disclosure discovered encode escalation execution exploit exploitation files firewall following formats future gain hashed host http including information injection instance instead issues joins jon launch lead live log malicious management master may most multiple munshaw only open org out packet password patch pending platform please policy privilege product range read recently refer released request responsibly rule rules secure selected sends serious session sharing similar snort snortâ“¡ software source specially spotlight: steal stream streaming subject talos targeted tested them these three triggered user users version video videos vulnerabilities vulnerabilities: vulnerability vulnerability: way web who wide will worked wwbn your |
| Tags | Vulnerability Guideline |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.