The vulnerability in WWBN AVideo (<= 29.0) involves the git.json.php file at the web root executing 'git log -1' and returning the full output to unauthenticated users. This results in exposure of sensitive information such as the deployed commit hash, developer PII (names and emails), and commit messages that may contain internal or security-related details. This information disclosure is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). There is no official patch or remediation available at the time of publication.

The vulnerability allows unauthenticated attackers to obtain sensitive information including the exact software version via commit hash, developer personal information, and potentially sensitive commit messages. This can facilitate targeted attacks by enabling version fingerprinting against known vulnerabilities and exposing PII. However, it does not directly allow modification or denial of service, resulting in a medium impact severity.

As no official patch or fix is currently available, users should consider restricting access to the git.json.php file or removing it from the web root to prevent unauthorized information disclosure. Monitor the vendor advisory for updates regarding official remediation or patches. Avoid relying on this information exposure for security decisions until a fix is released.