CVE-2020-36893

Summary

Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system files such as win.ini.

Affected Software

Weaknesses

• CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5585.php

References

• https://www.exploit-db.com/exploits/48766
• http://www.eibiz.co.th
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5585.php
• https://www.vulncheck.com/advisories/eibiz-i-media-server-digital-signage-directory-traversal-vulnerability

• ←Previous
• Next→