CVE-2023-30860
published 2023-05-08CVE-2023-30860: WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user…
PriorityP427medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.71%
49.0th percentile
WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert malicious scripts. Since any USER including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and takeover of any accounts. Version 12.4 contains a patch for this issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | < 12.4 | 12.4 |
| wwbn | avideo | >= 0 < 12.4 | 12.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account
osv·2023-05-01
CVE-2023-30860 [HIGH] WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account
WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account
In AVideo, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but I found out that it did not properly sanitize the malicious characters when creating a Meeting Room. This leads the attacker to put malicious scripts.
Impact:
Since any USER including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and takeover of any accounts without user interaction.
Step to Reproduce:
1. As normal USER go to Meet -> Schedule
https://demo.avideo.com/plugin/Meet/
2. In "Meet topic" field put XSS payload
Example: ">
3. Then click Save
4. Now as ADMIN go to Meet -> Schedule -> Upcoming
https://dem
GHSA
WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account
ghsa·2023-05-01
CVE-2023-30860 [HIGH] CWE-79 WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account
WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account
In AVideo, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but I found out that it did not properly sanitize the malicious characters when creating a Meeting Room. This leads the attacker to put malicious scripts.
Impact:
Since any USER including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and takeover of any accounts without user interaction.
Step to Reproduce:
1. As normal USER go to Meet -> Schedule
https://demo.avideo.com/plugin/Meet/
2. In "Meet topic" field put XSS payload
Example: ">
3. Then click Save
4. Now as ADMIN go to Meet -> Schedule -> Upcoming
https://dem
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-05-08
Published