AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
Résumé
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
Description d'origine
La description telle que publiée par la source (souvent en anglais).
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the objects/playlistsVideos.json.php endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including watch_later and favorite types) are correctly hidden from listing endpoints via playlistsFromUser.json.php, but their contents are directly accessible through this endpoint by providing the sequential integer playlists_id parameter. Commit bb716fbece656c9fe39784f11e4e822b5867f1ca has a patch for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com