CVE-2020-37158

Name of the Vulnerable Software and Affected Versions AVideo Platform version 8.1

Description The software contains a cross-site request forgery issue that allows attackers to reset user passwords. This is possible by exploiting the password recovery mechanism. Attackers can create malicious requests to the /recoverPass API endpoint using a user's recovery token to change account credentials without needing to authenticate. The vulnerable parameter is the user's recovery token.

Recommendations Apply updates to address the issue in AVideo Platform version 8.1. As a temporary workaround, consider restricting access to the /recoverPass API endpoint to minimize the risk of exploitation.