CVE-2022-32282
22.08.2022, 19:15
An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges.Enginsight
| Vendor | Product | Version |
|---|---|---|
| wwbn | avideo | 11.6 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-836 - Use of Password Hash Instead of Password for AuthenticationThe software records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.
- CWE-287 - Improper AuthenticationWhen an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
References