CVE-2023-50172: WWBN AVideo recovery notification bypass vulnerability
Summary
CVE-2023-50172: WWBN AVideo recovery notification bypass vulnerability. Affects wwbn/avideo versions < 12.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WWBN AVideo is an open-source video sharing platform developed by WWBN. It allows users to upload, share, and stream videos. The vulnerability affects the userRecoverPass.php captcha validation functionality in the dev master commit 15fed957fb. This vulnerability allows an attacker to bypass the recovery notification process and silently create a recovery pass code for any user.
Vulnerability Detail
The vulnerability arises from a flaw in the captcha validation functionality of WWBN AVideo. By sending a specially crafted HTTP request, an attacker can exploit this flaw to create a recovery pass code without triggering a notification. This can lead to unauthorized access to user accounts and potential misuse of the recovery pass code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is recommended to apply the official fix or update to a secure version as soon as possible.
Conclusion
The WWBN AVideo recovery notification bypass vulnerability allows an attacker to create a recovery pass code for any user without triggering a notification. This can lead to unauthorized access to user accounts. It is crucial for users of WWBN AVideo to update to a secure version or apply the official fix as soon as possible. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for wwbn/avideo →
FAQ
WWBN AVideo is an open-source video sharing platform developed by WWBN.
This vulnerability allows an attacker to bypass the recovery notification process and silently create a recovery pass code for any user, potentially leading to unauthorized access to user accounts.
To fix this vulnerability, the developers of WWBN AVideo should update the affected version to a secure release that includes a patch for this issue. Users should ensure they are running the latest version and apply any available updates.
Currently, there is no known workaround for this vulnerability. It is recommended to apply the official fix or update to a secure version as soon as possible.
For more information about this vulnerability, you can refer to the official GitHub advisory database or contact the WWBN AVideo development team.
Related vulnerabilities
Recent vulnerabilities recorded for wwbn/avideo.
