Description
WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist videos, or forge video suggestions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | < 24.0 | 24.0 |
References
- GitHub Security Advisory (GHSA-9pf9-6jr6-fvjr) vendor-advisory
- VulnCheck Advisory: WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints third-party-advisory