GHSA-WJ6R-53F5-Q789严重已审查已撤回

Duplicate Advisory: AVideo contains Command injection when embedding a video link

OSV 1.4.0 · github-reviewed · 修改于 2023-04-28 03:54

发布时间

2023-04-26 02:30

GitHub 审查时间

2023-04-28 03:52

NVD 发布时间

2023-04-26 00:15

源文件

advisories/github-reviewed/2023/04/GHSA-wj6r-53f5-q789/GHSA-wj6r-53f5-q789.json

该公告已于 2023-04-28 03:54 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pgvh-p3g4-86jw. This link is maintained to preserve external references.

Original Description

Impact:

An attacker could execute remote code on a system running wwbn/avideo

Step to Reproduce:

Go to the My Videos tab

https://demo.avideo.com/mvideos

Click "Embed a video link"

Append a command to the url as a query string. eg. ?whoami

then click Save

This issue has been resolved in commit 236228f15

受影响的软件包

Packagist

wwbn/avideo

ECOSYSTEM

标识信息

别名 / CVE

无

CWE

CWE-78CWE-79

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-wj6r-53f5-q789",
  "aliases": [],
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-pgvh-p3g4-86jw. This link is maintained to preserve external references.\n\n## Original Description\n\nImpact:\n\nAn attacker could execute remote code on a system running wwbn/avideo\n\nStep to Reproduce:\n\n1. Go to the `My Videos` tab\n\nhttps://demo.avideo.com/mvideos\n\n2. Click \"Embed a video link\"\n\nAppend a command to the url as a query string. eg. `?whoami`\n\n\nthen click Save\n\nThis issue has been resolved in commit `236228f15`",
  "summary": "Duplicate Advisory: AVideo contains Command injection when embedding a video link",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.4"
            }
          ]
        }
      ],
      "package": {
        "name": "wwbn/avideo",
        "ecosystem": "Packagist"
      }
    }
  ],
  "modified": "2023-04-27T19:54:52Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
    }
  ],
  "published": "2023-04-25T18:30:23Z",
  "withdrawn": "2023-04-27T19:54:13Z",
  "references": [
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-pgvh-p3g4-86jw",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25313",
      "type": "ADVISORY"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-79"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": "2023-04-25T16:15:09Z",
    "github_reviewed_at": "2023-04-27T19:52:26Z"
  }
}