Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

WWBN AVideo Dev: Weak Password Recovery Code Can Be Faked

CVE-2023-49599 · published 2 years ago
Summary

A security weakness in WWBN AVideo's password recovery system allows an attacker to guess the admin password. This can happen if a hacker sends a series of carefully crafted requests to the system. To fix this, you should update to the latest version of WWBN AVideo or apply the necessary patches.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
composer wwbn avideo <= 12.4
– wwbn avideo 15fed957fb
cpe:2.3:a:wwbn:avideo:15fed957fb:*:*:*:*:*:*:*
Original advisory text
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege esca...
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force the salt offline, leading to forging a legitimate password recovery code for the admin user.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-331Insufficient Entropy
Timeline
Published10 Jan 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-wqcc-qf63-c2x4 · GHSA
CVE-2023-49599 · NVD
CVE-2023-49599 · OSV
Track software like this
Free during beta