CVE-2023-49599: WWBN AVideo Insufficient Entropy Vulnerability
Summary
CVE-2023-49599: WWBN AVideo Insufficient Entropy vulnerbaility. Affects wwbn/avideo versions < 12.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WWBN AVideo is a package available on Packagist that provides video streaming functionality. It is commonly used for creating video sharing platforms. The package includes features for user management, video uploading, and playback. The vulnerability in question is related to the generation of salts used for password recovery codes.
Vulnerability Detail
The WWBN AVideo package, specifically the dev master commit 15fed957fb, suffers from an insufficient entropy vulnerability. This vulnerability allows an attacker to gather system information through specially crafted HTTP requests. By offline brute-forcing the salt, the attacker can forge a legitimate password recovery code for the admin user. This can lead to privilege escalation and unauthorized access to the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to a fixed version as soon as possible.
Conclusion
The WWBN AVideo package is vulnerable to an insufficient entropy issue in the salt generation functionality. This can lead to privilege escalation and unauthorized access to the system. It is crucial to update the package to a fixed version (12.4 or later) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for wwbn/avideo →
FAQ
WWBN AVideo is a package available on Packagist that provides video streaming functionality. It is commonly used for creating video sharing platforms.
This vulnerability allows an attacker to gather system information and forge a legitimate password recovery code for the admin user, leading to privilege escalation and unauthorized access to the system.
To fix this vulnerability, update the WWBN AVideo package to version 12.4 or later, which includes a patch for this issue.
No, there is no known workaround for this vulnerability. It is crucial to update the package to a fixed version.
For more information about this vulnerability, you can refer to the CVE identifier CVE-2023-49599 and the GitHub Security Advisory GHSA-wqcc-qf63-c2x4.
Related vulnerabilities
Recent vulnerabilities recorded for wwbn/avideo.
