CVE-2026-84481

6.9 Moyenne

Publiée le 02/09/2026 à 01:17 · Modifiée le 08/09/2026 à 22:18 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.

Traduire en français

Produits concernés

WWBN AVideo

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-200

Références

https://github.com/WWBN/AVideo/security/advisories/GHSA-5jfh-mcm7-299m
https://www.vulncheck.com/advisories/wwbn-avideo-through-30.0-information-disclosure-via-mobilemanager
https://github.com/WWBN/AVideo/security/advisories/GHSA-5jfh-mcm7-299m

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories