Description (CNA)
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WWBN / AVideo | affected 0 through c91b5975d |
CWE
CWE-352
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-4h63-5723-hq25
- https://www.vulncheck.com/advisories/avideo-removeposter-php-cross-site-request-forgery-file-deletion
ADP enrichment
No English description supplied.
No references supplied.