GHSA-8wjr-gw73-9f2g: WWBN AVideo through 29.7.1 Privilege Escalation via Encoder video_id_hash
WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain videoidhash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and replay it through useVideoHashOrLogin() for password-less login, gaining plugin upload, configuration, and user management access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already hold a delegated Videos Admin role. The flaw lets that user retrieve video_id_hash values for videos owned by other users, including administrators.
What access can an attacker obtain after exploiting it?
The attacker can replay an administrator-bound video_id_hash through useVideoHashOrLogin() for password-less login. This can provide access to plugin uploads, configuration, and user management.
Are versions later than 29.7.1 affected?
The available information identifies WWBN AVideo through version 29.7.1 as affected. It does not establish whether later versions are vulnerable or fixed.