Vulnerability · Published Feb 1, 2021 · Assigned by GitHub_M
CVE-2021-21286Authorization Bypass in AVideo Platform
High 7.7
In plain English
A high-severity incorrect authorization in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.8%top 43.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the pass hash and the recoverPass hash.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-xq8j-fhg5-hr39 x_refsource_CONFIRM
- https://avideo.tube/ x_refsource_MISC