CVE-2020-23489: Missing Authorization

May 24, 2022 (updated February 3, 2023)

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.

References

cube01.io/blog/Avideo-Remote-Code-Execution.html
github.com/WWBN/AVideo/commit/ecc5f40470bbafff231133f58db1df70f47bfb33
github.com/WWBN/AVideo/issues/3117
github.com/WWBN/AVideo/security/advisories/GHSA-46px-7w93-j5mw
github.com/advisories/GHSA-2mgx-226x-8pwv
nvd.nist.gov/vuln/detail/CVE-2020-23489

Code Behaviors & Features

Detect and mitigate CVE-2020-23489 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →