VulnerabilityModified
CVE-2021-21286
In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control.
HIGH 8.8EPSS 0.77%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.77%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the pass hash and the recoverPass hash.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.77% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- wwbn/avideo
- Source
- security-advisories@github.com
References
- https://avideo.tube/Vendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-xq8j-fhg5-hr39Third Party Advisory
- https://avideo.tube/Vendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-xq8j-fhg5-hr39Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.