PT-2026-84540 · Avideo · Avideo+1
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
AVideo versions prior to 30.0
Description
An information disclosure issue exists in the MobileManager plugin. An unauthenticated visitor can send a GET request to the 'plugin/MobileManager/getConfiguration.json.php' endpoint to retrieve sensitive configuration data. The exposed information includes TLS private key file paths, socket configuration details, platform version, and debug flags, which could facilitate further targeted attacks.
Recommendations
Update AVideo to a version later than 30.0.
Restrict access to the 'plugin/MobileManager/getConfiguration.json.php' endpoint to prevent unauthenticated access.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Avideo
Mobilemanager