CVE-2023-32073: Improper Neutralization of Special Elements used in a Command ('Command Injection')

May 12, 2023

WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at plugin/CloneSite/cloneClient.json.php which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.

References

github.com/WWBN/AVideo/commit/1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3
github.com/WWBN/AVideo/security/advisories/GHSA-2mhh-27v7-3vcx
github.com/advisories/GHSA-2mhh-27v7-3vcx
nvd.nist.gov/vuln/detail/CVE-2023-32073

Code Behaviors & Features

Detect and mitigate CVE-2023-32073 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →