CVE-2026-43873

{"id": "CVE-2026-43873", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43873", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T12:56:05.654210Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 29.0"}]}]}], "published": "2026-05-11T22:22:11.703", "references": [{"url": "https://github.com/WWBN/AVideo/commit/e6566f56a28f4556b2a0a09d03717a719dcb49da", "source": "security-advisories@github.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2", "source": "security-advisories@github.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'])) into the HTTP response body on every unauthenticated request. The unauthenticated error branch was intended to reject non-admin callers without a valid key, but the rejection message interpolates the expected key before die(). When the victim has CloneSite configured with a remote cloneSiteURL (standard federation/backup setup), the leaked myKey is exactly the credential that authenticates the victim to that remote server's cloneServer.json.php, allowing the attacker to impersonate the victim and trigger a full mysqldump of the remote's database to the remote's public videos/clones/ directory Commit e6566f56a28f4556b2a0a09d03717a719dcb49da contains an updated fix."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 29.0 inclusive, plugin/CloneSite/cloneClient.json.php devuelve el secreto compartido local de CloneSite ($objClone -> myKey, una constante md5($global[\u2019systemRootPath\u2019] . $global[\u2019salt\u2019])) en el cuerpo de la respuesta HTTP en cada solicitud no autenticada. La rama de error no autenticado estaba destinada a rechazar a los llamantes no administradores sin una clave v\u00e1lida, pero el mensaje de rechazo interpola la clave esperada antes de die(). Cuando la v\u00edctima tiene CloneSite configurado con una cloneSiteURL remota (configuraci\u00f3n est\u00e1ndar de federaci\u00f3n/copia de seguridad), la myKey filtrada es exactamente la credencial que autentica a la v\u00edctima en el cloneServer.json.php de ese servidor remoto, permitiendo al atacante suplantar a la v\u00edctima y activar un mysqldump completo de la base de datos del remoto en el directorio p\u00fablico videos/clones/ del remoto. El commit e6566f56a28f4556b2a0a09d03717a719dcb49da contiene una correcci\u00f3n actualizada."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "security-advisories@github.com"}