AVideo Insecure Direct Object Reference Vulnerability Allowing Unauthorized Video Metadata Modification

A vulnerability exists in AVideo versions prior to 20.0, allowing users with upload permissions to arbitrarily modify the rotation metadata of any video. This insecure direct object reference (IDOR) vulnerability arises because the endpoint checks for upload rights but does not verify ownership or management privileges for the video being edited.

Impact

Exploitation of this vulnerability allows for unauthorized modification of video rotation metadata, which could disrupt the intended presentation or usage of the video.

Remediation

Users can upgrade to AVideo version 20.0 or later, where this vulnerability has been addressed.