CyberRota Analysis
AI-GeneratedThe vulnerability affects the showAlertMessage() function in WWBN AVideo, allowing attackers to exploit a reflected cross-site scripting flaw by injecting unencoded JavaScript through a crafted Referer header. This can lead to arbitrary code execution in the context of the site for users who visit from a malicious page. Organizations using this Java-based application should prioritize patching to mitigate the risk of client-side attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage() function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing */ to close the comment and inject arbitrary JavaScript that executes in the site origin for visitors arriving from the attacker-controlled page.