CVE-2021-21286CWE-863

Authorization Bypass in AVideo Platform

High · published February 1, 2021

CVSS v3.1
7.7
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the pass hash and the recoverPass hash.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00770 · 55.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2021-02-01T15:25Z
EPSS history
Timeline
  • 01 FEB 15:25Z
    Authorization Bypass in AVideo Platform
    cvelistv5