CVE-2022-32772 - CVE House

Back to Database

Status published Critical CVE-2022-32772

A cross-site scripting (xss) vulnerability exists in the footer alerts...

9.6 CVSS

Vulnerability Description

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "msg" parameter which is inserted into the document with insufficient sanitization.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-32772

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from WWBN

View All →

A cross-site scripting (xss) vulnerability exists in the videosList page...

A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg...

An incomplete blacklist exists in the .htaccess sample of WWBN...

A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId...

A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri...

Affected Vendor

WWBN

View all reports →

Affected Software

AVideo

Vulnerable Versions:

11.6, dev master commit 3f7c0364

Timeline

Official Publish: August 22nd, 2022

Last Modified: April 15th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement