Horizon Alert
Summary of the vulnerability and why it matters
This CVE concerns a stored cross-site scripting vulnerability in the WWBN AVideo platform that could allow authenticated users to execute malicious scripts in the browsers of other users, including administrators, when viewing specific video content. The main concern is confirming relevance and exposure.
- Malicious scripts can run in user browsers.
- Vulnerability affects video platform users, including admins.
- Confirm if AVideo is used and affected.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by creating a new category with malicious JavaScript embedded in its name or icon class. This malicious code is stored and later displayed on video watch pages or gallery entries, triggering in the browser of any user who views these pages, including administrators.
- Authenticated user with upload permission can create categories.
- Visiting a video page or gallery entry triggers the stored script.
- Potential for session hijacking and unauthorized actions.
Live Threat
Current exploitation, exposure, and threat context
When the CustomizeUser option is enabled, authenticated users with upload permissions could create categories with malicious JavaScript. This payload would then execute in the browser of any visitor, including administrators, who views a video assigned to that category, potentially allowing unauthorized actions using the victim's session.
- Category names and icons.
- Cross-site scripting via category creation.
- Unauthorized actions with victim's session.
Operational Fix
Recommended remediation, mitigation, and detection steps
Given that WWBN AVideo is a web-based platform, the platform or application owners are likely responsible for addressing this stored cross-site scripting vulnerability. The first practical step involves identifying all instances of AVideo within your environment, confirming their reachability and criticality, and then locating the specific owner accountable for each instance to plan remediation efforts.
- Identify AVideo instances and accountable owners.
- Verify user category creation and impact.
- Plan remediation with vendor coordination.
