CVE-2025-34438

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-34438

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34438.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-34438

Published

2025-12-17T19:51:06Z

Modified

2026-08-12T03:51:41Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

AVideo < 20.1 IDOR Arbitrary Video Rotation

Details

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/34xxx/CVE-2025-34438.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "20.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "20.1"
                }
            ],
            "source": "CPE_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/wwbn/avideo

Affected ranges

Type

GIT

Repo

https://github.com/wwbn/avideo

Events

Introduced

Fixed

4a53ab2056

Fixed

c2feaf25cb

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34438.json"