CVE-2022-32778 Information disclosure in AVideo
Attackers can steal session and password cookies via JavaScript or non-HTTPS connections due to missing security flags, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-32778?
CVE-2022-32778 is a high-severity vulnerability in Wwbn Avideo, published on 22 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the session cookie to be leaked over non-HTTPS connections. This could allow an attacker to steal the session cookie via crafted HTTP requests.This vulnerability is for the pass cookie, which contains the hashed password and can be leaked via JavaScript.
Weakness: CWE-732
Which versions are affected by CVE-2022-32778?
It affects 1 product.
Products include Wwbn Avideo.
How do I fix CVE-2022-32778?
No fix has been published for CVE-2022-32778 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-32778 being exploited?
There is no known exploitation of CVE-2022-32778 in the wild and no public exploit code.
Other vulnerabilities in Wwbn Avideo
- CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
- CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
- CVE-2022-30534 Command injection in AVideo
- CVE-2022-30547 Path traversal in AVideo
- CVE-2022-32572 Command injection in AVideo
Sources
Also known as GHSA-jg84-q5c2-38cr.