CVE-2025-34438

Katalog CVE

CVSS 8.1 · High EPSS 0,28%

Kerentanan Authorization Bypass Through User-Controlled Key pada wwbn avideo. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video.

Rincian

Terbit di NVD

17 Desember 2025

Terakhir diubah

25 September 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 19,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WWBN/AVideo/commit/4a53ab2056 patch
• https://github.com/WWBN/AVideo/commit/c2feaf25cb patch
• https://www.vulncheck.com/advisories/avideo-idor-arbirary-video-rotation advisory pihak ketiga
• https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/