CVE-2023-30860

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-30860

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30860.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-30860

Aliases

GHSA-xr9h-p2rc-rpqm

Published

2023-05-08T18:04:09Z

Modified

2026-08-12T03:51:46Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

Details

WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert malicious scripts. Since any USER including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and takeover of any accounts. Version 12.4 contains a patch for this issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30860.json"
}

References

Affected packages

Git / github.com/wwbn/avideo

Affected ranges

Type

GIT

Repo

https://github.com/wwbn/avideo

Events

Introduced

Fixed

25305ffb07b87798db52536cda0329c988e6dac7

Database specific

Show details

{
    "cpe": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "12.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

10.*

10.8

Other

11.*

11.1

11.1.1

11.5

11.6

2.*

2.2

2.7

3.*

3.4

4.*

4.0

7.*

7.2

7.3

7.4

7.6

7.7

7.8

8.*

8.1

8.5

8.6

8.7

8.9

8.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30860.json"