An insecure direct object reference vulnerability in WWBN AVideo allows authenticated users with upload permissions to modify the rotation metadata of arbitrary videos without proper authorization.

This vulnerability is classified as an IDOR flaw (CWE-639) where the application endpoint performs a capability check for uploads but fails to validate if the authenticated user owns or holds management rights over the specific video being modified. An attacker with standard upload privileges can manipulate video metadata for content they do not own.

Successful exploitation allows unauthorized modification of system content, which can lead to the disruption of video services or the defacement of media assets. While the CVSS score of 8.1 indicates a high severity, the primary risk involves unauthorized data manipulation rather than full system compromise. Such incidents can undermine user trust in the platform and cause significant operational disruption for organizations relying on AVideo for media distribution.

Immediate Action: Update all AVideo installations to version 20.1 or later immediately to apply the required authorization checks.

Proactive Monitoring: Review web server and application access logs for unusual patterns of metadata modification requests or rapid, high-volume updates to video objects.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block suspicious requests targeting video object management endpoints, specifically those attempting to modify assets outside of the user's known library.

Public Exploit Available: No

The presence of this IDOR vulnerability necessitates immediate attention to ensure integrity across the AVideo platform. Administrators should prioritize upgrading to version 20.1, as this release includes the necessary logic to enforce proper ownership validation. Failure to apply this update leaves the platform susceptible to unauthorized content modification by any authenticated user.