CVE-2022-32778: High severity wwbn avideo vulnerability
An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the session cookie to be leaked over non-HTTPS connections. This could allow an attacker to steal the session cookie via crafted HTTP requests.This vulnerability is for the pass cookie, which contains the hashed password and can be leaked via JavaScript.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-32778?
CVE-2022-32778 is considered a medium severity information disclosure vulnerability.
How do I fix CVE-2022-32778?
To fix CVE-2022-32778, ensure that the session and pass cookies are set with the HttpOnly and secure flags.
What are the potential risks of CVE-2022-32778?
The risks of CVE-2022-32778 include unauthorized access to sensitive user information through JavaScript due to the lack of security flags on cookies.
Which versions of AVideo are affected by CVE-2022-32778?
CVE-2022-32778 affects WWBN AVideo version 11.6 and the dev master commit 3f7c0364.
How can I mitigate the effects of CVE-2022-32778?
Mitigation of CVE-2022-32778 can be achieved by implementing secure coding practices and cookie management to ensure proper flag settings.