CVE-2024-31819: WWBN AVideo Remote Code Execution
Summary
CVE-2024-31819: WWBN AVideo Remote Code Execution. Affects wwbn/avideo versions >= 12.4, < 14.3. Fixed in 14.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WWBN AVideo is an open-source video sharing platform. It allows users to upload, share, and stream videos. The vulnerability in WWBN AVideo versions 12.4 through 14.2 enables remote attackers to execute arbitrary code by exploiting the systemRootPath parameter of the submitIndex.php component.
Vulnerability Detail
The vulnerability in WWBN AVideo allows an attacker to execute arbitrary code remotely. By manipulating the systemRootPath parameter of the submitIndex.php component, an attacker can inject and execute malicious code on the server. This can lead to various consequences, including unauthorized access, data theft, and complete compromise of the affected system.
How To Fix
Minimum fixed version
14.3
This is the first release that contains the fix.
composer require wwbn/avideo:14.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to restrict access to the submitIndex.php component or disable it if not required. This can be achieved by modifying the server configuration or implementing access control rules. Here is an example of an Apache .htaccess rule to restrict access:
<Files submitIndex.php>
Require all denied
</Files>
Conclusion
The remote code execution vulnerability in WWBN AVideo versions 12.4 through 14.2 allows attackers to execute arbitrary code on the affected server. It is crucial to upgrade to version 14.3 or later to mitigate this vulnerability. Additionally, implementing the provided workaround can help reduce the risk until the upgrade is performed.
See every vulnerability recorded for wwbn/avideo →
FAQ
This vulnerability allows remote attackers to execute arbitrary code on the affected server. It can lead to unauthorized access, data theft, and complete compromise of the system.
WWBN AVideo versions 12.4 through 14.2 are affected by this vulnerability.
Yes, upgrading WWBN AVideo to version 14.3 or later will fix this vulnerability.
Yes, you can restrict access to the submitIndex.php component or disable it if not required. Refer to the provided workaround section for more details.
You can find more information about this vulnerability in the official advisory published by the GitHub Security Advisory Database.
Related vulnerabilities
Recent vulnerabilities recorded for wwbn/avideo.
