Authenticated Privilege Escalation in AVideo via Reminder Creation

Executive Summary

This vulnerability in WWBN AVideo allows authenticated users to create scheduler reminders for private live schedules they cannot access. The system fails to validate permissions before processing the request in the remindMe.json.php file, enabling attackers to learn private schedule titles through email notifications.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to the remindMe.json.php endpoint by reviewing server logs for suspicious requests to plugin/Live/remindMe.json.php. Look for repeated attempts to create reminders for private schedules by non-owners. Verify if users can access schedules they shouldn't by testing the endpoint with different user permissions.

Useful 0 Not Useful 0

Impact Analysis

If you use WWBN AVideo, an attacker with a valid account could exploit this to view private schedule titles and receive notifications about schedules they should not access. This could lead to information leakage about sensitive or restricted content.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls for sensitive data, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized access to private schedules may result in non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest patch if available. If no patch exists, restrict access to the remindMe.json.php endpoint by implementing proper authorization checks. Ensure logged-in users can only create reminders for schedules they have permission to view. Monitor for unusual activity in scheduler reminders.

Useful 0 Not Useful 0