CVE-2022-32772: XSS

Published Aug 22, 2022

Updated

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "msg" parameter which is inserted into the document with insufficient sanitization.

Affected Software

1 affected component

WWBN AVideo=11.6

Event History

Aug 22, 2022

CVE Published

via MITRE·06:27 PM

Data Sourced

via MITRE·06:27 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-32772?

CVE-2022-32772 is classified as a moderate severity cross-site scripting vulnerability.

How do I fix CVE-2022-32772?

To fix CVE-2022-32772, update WWBN AVideo to version 11.7 or later where the vulnerability is addressed.

What can attackers do with CVE-2022-32772?

Attackers can exploit CVE-2022-32772 to execute arbitrary JavaScript in the context of an authenticated user.

Which versions of WWBN AVideo are affected by CVE-2022-32772?

CVE-2022-32772 affects WWBN AVideo versions 11.6 and earlier.

Is user authentication required to exploit CVE-2022-32772?

Yes, an attacker needs to trick an authenticated user into sending a crafted HTTP request to exploit CVE-2022-32772.