CVE-2023-30854
CVE-2023-30854 · WWBN AVideo vulnerable to OS Command Injection
This page contains facts from public vulnerability sources. Check the original advisory before updating.
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.
CVSS 8.8 · High · EPSS 5.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
avideo
- Versions
- < 12.4: Affected
No fix published
wwbn/avideo Packagist
- Versions
- 10.4
- 10.8
- 11
- 11.1
- 11.1.1
- 11.5
- 11.6
- Affected ranges
- ECOSYSTEM: < 12.4
Update to 12.4