Vulnerability · Published Aug 22, 2022 · Assigned by talos

CVE-2022-32778

High 7.5

In plain English

A high-severity incorrect permission assignment in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)2.4%top 15.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the session cookie to be leaked over non-HTTPS connections. This could allow an attacker to steal the session cookie via crafted HTTP requests.This vulnerability is for the pass cookie, which contains the hashed password and can be leaked via JavaScript.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	11.6dev master commit 3f7c0364

Weakness: CWE-732 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql x_refsource_CONFIRM
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1542 x_refsource_MISC