GitHub Advisoryadvisory · Packagist

GHSA-2mgx-226x-8pwv AVideo vulnerable to Improper Privilege Management

HIGH Published 2022-05-24 Modified 2023-02-03 Official page ↗
Aliases
CVE-2020-23489
Ecosystem
Packagist
Packages
wwbn/avideo
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269
Reviewed
2023-02-03

Affected packages

• Packagist wwbn/avideo: < 8.9 → fixed in 8.9

Description

The import.json.php file before 8.9 for AVideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, causing certain privilege checks to not be in place, leading to privilege escalation to admin. Local File Inclusion may also leak credentials and important files. Patches Upgrade to version 8.9

Related

Alias · CVE (1)

  • CVE-2020-23489 The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References