CVE-2022-32768 - CVE House

Back to Database

Status published Medium CVE-2022-32768

Multiple authentication bypass vulnerabilities exist in the objects id handling...

4.8 CVSS

Vulnerability Description

Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to bypass authentication by guessing a sequential ID, allowing them to take over the another user's streams.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-32768

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from WWBN

View All →

A cross-site scripting (xss) vulnerability exists in the videosList page...

A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg...

An incomplete blacklist exists in the .htaccess sample of WWBN...

A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId...

A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri...

Affected Vendor

WWBN

View all reports →

Affected Software

AVideo

Vulnerable Versions:

11.6, dev master commit 3f7c0364

Timeline

Official Publish: August 22nd, 2022

Last Modified: April 15th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal