CVE-2020-37172

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

CVSS 8.5 HIGHEPSS 0.7%CWE-640

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Produtos afetados

AVideo · AVideo Platform

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://avideo.com https://github.com/WWBN/AVideo https://www.exploit-db.com/exploits/48003 https://www.vulncheck.com/advisories/avideo-platform-cross-site-request-forgery-password-reset