CVE-2025-32946

Katalog CVE

CVSS 5.3 · Medium EPSS 0,37%

Kerentanan Improper Ownership Management pada framasoft peertube. Skor CVSS 3.1 5.3 (Medium) menurut jfrog.com.

Deskripsi (NVD)

This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.

Rincian

Terbit di NVD

15 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber jfrog.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-282: Improper Ownership Management

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://research.jfrog.com/vulnerabilities/peertube-arbitrary-playlist-creation-activitypub/ exploit · advisory pihak ketiga
• https://github.com/Chocobozzz/PeerTube/releases/tag/v7.1.1 release notes