by Kastro
Paper/Archive/CVE-2020-37172

CVE-2020-37172

AVideo AVideo Platform — AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.3.553 × 2011.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.

Affected

ProductAffectedFixed inSource
AVideo Platform8.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)8.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitexploit-db.com/exploits/48003refavideo.comrefgithub.com/WWBN/AVideowriteupvulncheck.com/advisories/avideo-platform-cross-site-request-forgery-password-reset