CyberRota Analysis
AI-GeneratedAVideo contains a server-side request forgery vulnerability in its EPG parser, allowing authenticated uploaders to exploit the epg_link parameter to access arbitrary internal URLs. This could lead to unauthorized access to sensitive internal resources, posing a risk to the integrity and confidentiality of the system. Organizations using AVideo, particularly those with user-generated content features, should prioritize addressing this vulnerability to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epg_link parameter during video upload, which is validated only for syntax and later fetched server-side during EPG generation without SSRF protection checks.