Loading...
Skip to main content
GeekWala

CVE-2023-49599 — Vulnerability in wwbn/avideo — CVE Details

CRITICAL

WWBN AVideo Insufficient Entropy vulnerbaility

Published January 10, 2024Updated November 4, 2025Source: osv

Summary

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and bruteforce the salt offline, leading to forging a legitimate password recovery code for the admin user.

Advisory Timeline

  • First published January 10, 2024 (1006 days ago).
  • Last revised November 4, 2025 — 664 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
wwbn/avideo
packagist
10.4, 10.8, 11, 11.1 (+4 more)Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-49599?
WWBN AVideo Insufficient Entropy vulnerbaility This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2023-49599?
CVE-2023-49599 affects wwbn/avideo. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-49599 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-wqcc-qf63-c2x4

Related CVEs

  • CVE-2026-28501
    CRITICAL

    AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

  • CVE-2026-28502
    CRITICAL

    AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

  • CVE-2026-41064
    HIGH

    WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection

  • CVE-2026-33719
    HIGH

    AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment

  • CVE-2026-40925
    HIGH

    WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

  • CVE-2026-33647
    HIGH

    AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

  • CVE-2026-33479
    HIGH

    AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

  • CVE-2026-41304
    HIGH

    WWBN AVideo: RCE cause by clonesite plugin

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies