CVE-2023-30854

WWBN AVideo vulnerable to OS Command Injection

AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.

Affected

WWBN · AVideo

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

5.17% chance of exploitation in the next 30 days, 92nd percentile

Published

2023-04-28

Updated

2025-01-30

Proof-of-concept exploits (1)

• jmrcsnchz/CVE-2023-308541★ · 2023-04-28

Security advisories

• WWBN/AVideo/security/advisories/GHSA-6vrj-ph27-qfp3
• advisories/GHSA-6vrj-ph27-qfp3

References

• CVE Record
• NVD entry

Related

• CVE-2023-32073
• CVE-2024-0264
• CVE-2024-0265