{
  "GSD": {
    "alias": "CVE-2023-50172",
    "id": "GSD-2023-50172"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-50172"
      ],
      "details": "A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to silently create a recovery pass code for any user.",
      "id": "GSD-2023-50172",
      "modified": "2023-12-13T01:20:31.274976Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "talos-cna@cisco.com",
        "ID": "CVE-2023-50172",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "AVideo",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "dev master commit 15fed957fb"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "WWBN"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Discovered by Claudio Bozzato of Cisco Talos."
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-640",
                "lang": "eng",
                "value": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1897",
            "refsource": "MISC",
            "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1897"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:wwbn:avideo:15fed957fb:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4199C617-A976-4F18-ADD2-C26A5B046CC3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user."
          },
          {
            "lang": "es",
            "value": "Existe una vulnerabilidad de omisi\u00f3n de notificaci\u00f3n de recuperaci\u00f3n en la funcionalidad de validaci\u00f3n de captcha userRecoverPass.php de la confirmaci\u00f3n maestra de desarrollo de WWBN AVideo 15fed957fb. Una solicitud HTTP especialmente manipulada puede dar lugar a la creaci\u00f3n silenciosa de un c\u00f3digo de acceso de recuperaci\u00f3n para cualquier usuario."
          }
        ],
        "id": "CVE-2023-50172",
        "lastModified": "2024-01-18T14:28:59.977",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "talos-cna@cisco.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-01-10T16:15:49.583",
        "references": [
          {
            "source": "talos-cna@cisco.com",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1897"
          }
        ],
        "sourceIdentifier": "talos-cna@cisco.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-640"
              }
            ],
            "source": "talos-cna@cisco.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}