Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2020-37172 is a high-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in Wwbn Avideo. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2020-37172 is a cross-site request forgery (CSRF) vulnerability in AVideo Platform version 8.1. The flaw resides in the password recovery mechanism, particularly the recoverPass endpoint, which attackers can exploit by crafting malicious requests that leverage a user's recovery token to reset passwords without requiring authentication.
Unauthenticated attackers with network access can exploit this vulnerability, which has a CVSS score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and is associated with CWE-640. Exploitation allows them to change user account credentials, potentially granting unauthorized access to affected accounts.
Advisories and additional details are documented in resources such as the Vulncheck advisory at https://www.vulncheck.com/advisories/avideo-platform-cross-site-request-forgery-password-reset, an Exploit-DB entry at https://www.exploit-db.com/exploits/48003, and official AVideo sites including https://avideo.com and https://github.com/WWBN/AVideo; practitioners should review these for mitigation guidance and patches.
A proof-of-concept exploit is available on Exploit-DB, highlighting the risk of real-world exploitation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31128
Vulnerability Data
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials…
more
without authentication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2020-37172 is a CSRF vulnerability in a public-facing web application (AVideo Platform) that allows unauthenticated remote exploitation to reset user passwords, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms to ensure session authenticity, directly preventing CSRF attacks by blocking forged requests to the recoverPass endpoint.
AC-3 enforces access control policies that require validation of request authenticity for sensitive password recovery operations.
IA-5 manages recovery tokens as authenticators, ensuring secure handling and validation to mitigate unauthorized password resets via CSRF.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential lifecycle management directly includes password reset/recovery flows.
Identity proofing is the core control that prevents weak or bypassed recovery mechanisms.
Authentication policy covers strength/MFA but does not address recovery path weaknesses.
Secure SDLC reduces implementation flaws but is not specific to password-recovery design.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Strong authentication-information lifecycle rules directly address weak password-recovery flows.
Secure-SDLC practices can embed strong recovery design, yet the control is broader than this single weakness.
Application-security requirements can mandate secure recovery flows, but the control covers many other requirements.
Secure-coding standards can prevent weak recovery implementations, yet the control is wider in scope.
Secure-authentication requirements include robust forgotten-password procedures.
Proper access-rights provisioning can limit who can trigger recovery, but does not fix the recovery mechanism itself.