LiveActive security incident?Get immediate response
CVE Record

CVE-2020-23489: The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability.

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2020-23489 affects AVideo before version 8.9. A vulnerable import.json.php file could allow deletion of configuration.php, weakening privilege checks and enabling a user to become an administrator. This is operationally serious for public AVideo sites because administrator access can compromise content, users, and site configuration.

Executive priority

Treat this as high priority for any public AVideo site or multi-user deployment. Admin escalation can threaten service integrity and user trust. If AVideo is not used, document non-exposure and no further action is needed.

Technical view

The source bundle describes a file deletion flaw in AVideo import.json.php before 8.9. Deleting configuration.php can cause privilege checks to be bypassed, allowing privilege escalation to admin. The supplied evidence does not provide CVSS, CWE, complete CPE data, or confirmed active exploitation.

Likely exposure

Most likely exposure is internet-facing or user-accessible AVideo deployments running versions before 8.9, especially where import.json.php is reachable. The CVE record does not provide normalized affected CPEs.

Exploitation context

The source bundle includes a public blog reference and upstream commit, but KEV is false and no supplied source confirms active exploitation. The available description supports privilege escalation through file deletion, not a broader exploit chain by itself.

Researcher notes

Evidence is sparse: the CVE text identifies AVideo before 8.9 and the impact path, while the bundled metadata lacks CVSS, CWE, and CPE details. Use the upstream commit and vendor materials to confirm exact patched versions and code-level behavior.

Mitigation direction

  • Inventory AVideo deployments and identify versions before 8.9.
  • Review the upstream commit and vendor release guidance for the fixed version.
  • Upgrade vulnerable AVideo instances to a fixed release when applicable.
  • Restrict access to import.json.php until remediation is complete.
  • Back up and monitor configuration.php for unexpected removal or changes.
  • Review administrator accounts for unauthorized additions or privilege changes.

Validation and detection

  • Confirm the running AVideo version on each deployment.
  • Check whether import.json.php is present and reachable.
  • Review logs for suspicious access to import.json.php.
  • Verify configuration.php exists and has expected ownership and permissions.
  • Confirm privilege checks still work after remediation.
  • Avoid destructive validation that deletes configuration files.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-23489 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.