WWBN AVideo Cross-Site Scripting Vulnerability in PlaylistOwnerUsersId Parameter

A cross-site scripting (XSS) vulnerability has been identified in WWBN AVideo versions 14.4 and the development master commit 8a8954ff. The issue arises in the managerPlaylists functionality, specifically within the PlaylistOwnerUsersId parameter. This vulnerability allows for arbitrary execution of JavaScript through a specially crafted HTTP request. An attacker could exploit this by tricking a user into visiting a webpage that triggers the XSS attack.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute malicious JavaScript in the context of the user's browser. This could lead to compromising user accounts, particularly those of administrators.

Remediation

Users are advised to update to the patched version released by the vendor.