What’s Vulnerable › Vulnerabilities

CVE-2020-23490

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-11-16 · updated 2026-06-17

Description

There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file.

Affected products

• WWBN AVideo: before 8.9 — fixed in 8.9

How to fix

Upgrade to a fixed version: WWBN AVideo 8.9. Check the vendor advisory for mitigations.

References

• https://cube01.io/blog/Avideo-Remote-Code-Execution.html
• https://github.com/WWBN/AVideo/commit/218c98cbd4a4a2c15745852bcd0f29faf101bd8c
• https://cube01.io/blog/Avideo-Remote-Code-Execution.html
• https://github.com/WWBN/AVideo/commit/218c98cbd4a4a2c15745852bcd0f29faf101bd8c

Get alerted when CVE-2020-23490 or the next vulnerability affects your stack