CVE-2020-37158highCWE-352CWE-640

CVE-2020-37158: high-severity vulnerability in AVideo Platform

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

Published · Updated

Follow this CVE+ Monitor AVideo Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.3%
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
AVideo · AVideo Platform
Related CVEs — AVideo Platform

In the same product, most dangerous first.

CVE-2020-37172HIGHAVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)EPSS 0.8%CVE-2020-37173HIGHAVideo Platform 8.1 - Information Disclosure (User Enumeration)EPSS 0.7%