Description (CNA)
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WWBN / AVideo | affected 0 through c3edcc274c389816d434acadac07ee78eaf330c1 |
CWE
CWE-639
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-m2c6-f5ww-j26v
- https://www.vulncheck.com/advisories/avideo-missing-authorization-in-addlivelink-php-livelink-update
ADP enrichment
No English description supplied.