CVE-2023-49599

2024-01-1016:15:48

CWE-331

[email protected]

web.nvd.nist.gov

cve-2023-49599

vulnerability

wwbn avideo

salt generation

http requests

privilege escalation

bruteforce

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force the salt offline, leading to forging a legitimate password recovery code for the admin user.

Affected configurations

Vulners

NVD

Node

wwbnavideoRange≤dev master commit 15fed957fb

VendorProductVersionCPE
wwbnavideo*cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wwbn	avideo	*	cpe:2.3:a:wwbn:avideo::::::::

CNA Affected

[
  {
    "vendor": "WWBN",
    "product": "AVideo",
    "versions": [
      {
        "version": "dev master commit 15fed957fb",
        "status": "affected"
      }
    ]
  }
]