CVE-2020-36895

EUVD-2020-30837
EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive configuration files via direct object reference. Attackers can retrieve the SiteConfig.properties file through an HTTP GET request, exposing administrative credentials, database connection details, and system configuration information.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Affected Products (NVD)
VendorProductVersion
eibizi-media_server_digital_signage
3.8.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.eibiz.co.th
https://www.exploit-db.com/exploits/48764
https://www.vulncheck.com/advisories/eibiz-i-media-server-digital-signage-unauthenticated-configuration-disclosure
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5583.php
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5583.php