Threats tagged 'ghsa-x968-qj2r-r49p'

AVideo versions up to 29.0 are vulnerable to a cross-site request forgery (CSRF) flaw in the videoAddNew.json.php endpoint. The vulnerability arises because the automatic CSRF protection and same-domain request checks are disabled when 'user' and 'pass' parameters are present, but these parameters are not validated. An attacker can trick an authenticated user with upload or administrative rights into submitting crafted cross-origin requests that modify video records, including ownership, access restrictions, and other metadata. No patch was available at the time of the advisory.