CVE-2025-34435
BaseFortify
Publication date: 2025-12-17
Last updated on: 2025-12-19
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | to 20.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2025-34435 is an insecure direct object reference (IDOR) vulnerability in AVideo versions prior to 20.0. It allows any authenticated user to delete media files that belong to other users because the affected endpoint checks if a user is logged in but does not verify if the user owns or has permission to edit the targeted video file. [2]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized deletion of media files owned by other users. An attacker who is authenticated can delete videos they do not own, potentially causing data loss, disruption of service, and loss of user trust. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability, monitor requests to the media deletion endpoints (such as delete.json.php) for authenticated users attempting to delete media files they do not own. You can look for unusual or unauthorized deletion attempts in web server logs or application logs. Specific commands depend on your environment, but for example, you could use grep to search logs for deletion requests: `grep 'delete.json.php' /path/to/access.log` and then correlate user IDs with ownership data. Additionally, testing with authenticated user accounts to attempt deletion of media files owned by other users can help confirm the vulnerability. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update AVideo to version 20.0 or later, where proper authorization checks have been implemented to ensure only owners or users with management permissions can delete media files. If updating is not immediately possible, restrict access to the vulnerable endpoints to trusted users only and monitor deletion activities closely. Applying patches from the commit identified by SHA 275a542 in the WWBN/AVideo repository can also mitigate the issue by enforcing authentication and ownership verification. [1, 2]