GHSA-wqcc-qf63-c2x4CriticalCVSS 9.8
WWBN AVideo Insufficient Entropy vulnerbaility
🔗 CVE IDs covered (1)
📋 Description
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and bruteforce the salt offline, leading to forging a legitimate password recovery code for the admin user.
🎯 Affected products1
- composer/wwbn/avideo:<= 12.4