CVE-2020-37172

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-37172

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-37172.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-37172

Published

2026-02-11T21:16:09.470Z

Modified

2026-03-10T23:21:15.773713Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.

References

Affected packages

Git / github.com/wwbn/avideo

Affected ranges

Type

GIT

Repo

https://github.com/wwbn/avideo

Events

Introduced

Last affected

37b6ae369466cd8b587c149bb7efbf2d0fe9bffd

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.1"
        }
    ]
}

Affected versions

2.*

2.2

2.4

2.7

3.*

3.4

3.4.1

4.*

4.0

4.0.1

4.0.2

5.*

5.0

6.*

6.5

7.*

7.2

7.3

7.4

7.5

7.6

7.7

7.8

8.*

8.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-37172.json"