CVE-2023-49810: WWBN AVideo Improper Restriction of Excessive Authentication Attempts Vulnerability
Summary
CVE-2023-49810: WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability. Affects wwbn/avideo versions < 12.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WWBN AVideo is a package available on Packagist that provides video streaming functionality. It allows users to upload, manage, and stream videos on their websites. The package includes features such as user authentication, video categorization, and search functionality. However, a vulnerability has been discovered in the package that allows an attacker to bypass login attempt restrictions and potentially brute force user credentials.
Vulnerability Detail
The vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. By sending a specially crafted HTTP request, an attacker can bypass the captcha and initiate a series of login attempts without being restricted. This can be abused to perform brute force attacks and gain unauthorized access to user accounts. The vulnerability has a CVSS score of 7.3, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix provided by the package maintainers.
Conclusion
The WWBN AVideo package is vulnerable to an improper restriction of excessive authentication attempts vulnerability. This can be exploited by attackers to bypass login attempt restrictions and perform brute force attacks. It is recommended to update the package to version 12.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for wwbn/avideo →
FAQ
WWBN AVideo is a package that provides video streaming functionality for websites. It allows users to upload, manage, and stream videos.
This vulnerability allows an attacker to bypass login attempt restrictions and perform brute force attacks to gain unauthorized access to user accounts.
To fix this vulnerability, update the WWBN AVideo package to version 12.4 or later.
No, there is no known workaround. It is crucial to apply the official fix provided by the package maintainers.
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for wwbn/avideo.
