CVE-2022-32282 — Use of Password Hash Instead of Password for Authentication in Avideo

CWE-836 — Use of Password Hash Instead of Password for AuthenticationCWE-287 — Improper Authentication4 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.5%
top 32.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Wwbn Avideo
Timeline
PublishedAug 22
Latest updateAug 23

Description

An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5wwbn/avideodev master commit 3f7c0364
▶NVDwwbn/avideo11.6

🔴Vulnerability Details

1
GHSA
GHSA-gqfq-r93q-hj3q: An improper password check exists in the login functionality of WWBN AVideo 11↗2022-08-23
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass↗2022-08-16
▶
Talos
Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass↗2022-08-16
▶