CVE-2020-23489

HIGH8.8EPSS 5.0%

AVideo vulnerable to Improper Privilege Management

發布日:2022/5/24修改日:2023/11/8

描述

The import.json.php file before 8.9 for AVideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, causing certain privilege checks to not be in place, leading to privilege escalation to admin. Local File Inclusion may also leak credentials and important files. ### Patches Upgrade to version 8.9

受影響套件(1)

Packagist/wwbn/avideofrom 0, < 8.9

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-23489
PATCHhttps://github.com/WWBN/AVideo
WEBhttps://cube01.io/blog/Avideo-Remote-Code-Execution.html
WEBhttps://github.com/WWBN/AVideo/commit/ecc5f40470bbafff231133f58db1df70f47bfb33
WEBhttps://github.com/WWBN/AVideo/issues/3117
WEBhttps://github.com/WWBN/AVideo/security/advisories/GHSA-46px-7w93-j5mw