Executive Summary

This vulnerability exists in WWBN AVideo, an open source video platform, in versions up to and including 29.0. The issue is in the plugin PayPalYPT, specifically in the agreementCancel.json.php file, which cancels a PayPal billing agreement using an attacker-supplied agreement parameter without verifying that the authenticated user actually owns that agreement.

As a result, a low-privilege authenticated user who obtains another user's PayPal billing agreement ID can silently suspend the victim's recurring subscription.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a low-privilege authenticated user to cancel another user's PayPal billing agreement without proper authorization, leading to loss of paid services for the victim and revenue loss for the platform.

While the CVE description does not explicitly mention compliance with standards such as GDPR or HIPAA, the unauthorized cancellation of billing agreements could potentially impact compliance by violating principles of data integrity and user consent.

Specifically, GDPR requires protecting user data and ensuring that actions affecting user services are authorized and transparent. This vulnerability could be seen as a failure to properly secure user transactions and billing data, which might lead to non-compliance with such regulations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause revenue loss to the platform because attackers can suspend recurring subscriptions without authorization.

It also causes loss of paid service to the victim, as their recurring subscription can be silently canceled by an attacker.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update WWBN AVideo to a version that includes the fix from commit 0da3dcff1eda2f497694bf82b559829471c292c2 or later.

This fix ensures that the plugin PayPalYPT/agreementCancel.json.php properly verifies that the authenticated user owns the PayPal billing agreement before allowing cancellation.

Until the update is applied, restrict access to the vulnerable endpoint to trusted users only and monitor for suspicious activity involving PayPal billing agreement cancellations.

Useful 0 Not Useful 0