CVE-2023-49589

Summary

CVE-2023-49589 is a newly disclosed vulnerability affecting the userRecoverPass.php script in WWBN AVideo's dev master commit 15fed957fb. This issue stems from insufficient entropy in the recoverPass generation functionality. A maliciously crafted HTTP request can exploit this vulnerability, enabling an attacker to recover arbitrary user passwords. The lack of sufficient entropy in the password recovery process poses a significant risk, as it undermines the security of user accounts on affected systems.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.