GHSA-8m5f-2xvp-2c8w

WWBN AVideo recovery notification bypass vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-50172

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	wwbn/avideo	<= 12.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to silently create a recovery pass code for any user.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-50172 advisory
https://github.com/WWBN/AVideo/commit/15fed957fb64b4055158acfc449bd7974346edb5 web
https://github.com/WWBN/AVideo package
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1897 web