CyberRota Analysis
AI-GeneratedAVideo is vulnerable due to an information exposure flaw in the feed/index.php file, which allows unauthenticated attackers to access channel owner email addresses by providing public channel names. This vulnerability enables attackers to enumerate email addresses from the RSS feed, potentially facilitating account takeover and phishing attacks. Organizations using AVideo should prioritize addressing this issue to protect user data and prevent exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through public channel names and extract them from the itunes:email and itunes:author RSS elements, enabling account takeover attempts and phishing campaigns.