FV Flowplayer Video Player Cloud Storage Configuration Disclosure

Executive Summary

This vulnerability affects the FV Flowplayer Video Player WordPress plugin before version 7.5.56.7212. It allows authenticated users with minimal permissions, such as Subscribers, to access sensitive information due to missing authorization and CSRF checks in cloud storage media browser handlers.

Useful 0 Not Useful 0

Detection Guidance

Check if the FV Flowplayer Video Player plugin is installed and verify its version. If it is below 7.5.56.7212, the system is vulnerable. Look for unauthorized access to cloud storage configurations or file listings by monitoring logs for unusual requests to cloud storage handlers.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this flaw to disclose the configuration and file listings of connected cloud storage accounts on the site. This may lead to unauthorized access to sensitive data stored in those accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure, potentially violating compliance requirements such as GDPR or HIPAA, which mandate strict controls over data access and protection.

Useful 0 Not Useful 0

Mitigation Strategies

Update the FV Flowplayer Video Player plugin to version 7.5.56.7212 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review user permissions to ensure only necessary access is granted.

Useful 0 Not Useful 0