CVE-2023-25313
Published: 25 April 2023
Summary
CVE-2023-25313 is a critical-severity OS Command Injection (CWE-78) vulnerability in Wwbn Avideo. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-25313 is an OS command injection vulnerability, tracked as CWE-78, that affects World Wide Broadcast Network AVideo versions before 12.4. The flaw is present in the Embed a video link feature and can be triggered through the video link input field, enabling remote code execution.
An unauthenticated attacker with network access can supply a malicious video link to execute arbitrary operating-system commands on the server. The vulnerability carries a CVSS 3.1 score of 9.8, reflecting that no user interaction or credentials are required and that successful exploitation can impact confidentiality, integrity, and availability.
The issue is documented in the GitHub Security Advisory GHSA-pgvh-p3g4-86jw, which provides the authoritative reference for remediation steps and any released patches. The current EPSS score stands at 0.0943 with an identical recorded peak, indicating no material post-disclosure increase in observed exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-0761
Vulnerability details
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.