CVE-2023-30854
WWBN AVideo vulnerable to OS Command Injection
Summary
WWBN AVideo vulnerable to OS Command Injection
Original description
The description as published by the source.
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint /plugin/CloneSite/cloneClient.json.php allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Packagist
wwbn/avideo
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web github.com