Sony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDOR
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.9%
exploitation probability
0.9%top 42% of all CVEs
observed exploitation
nono source reports it
Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access restrictions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Sony Electronics Inc. · Sony BRAVIA Digital SignageReferences
https://cxsecurity.com/issue/WLB-2020120031https://exchange.xforce.ibmcloud.com/vulnerabilities/192607https://packetstormsecurity.com/files/160344https://pro-bravia.sony.nethttps://pro-bravia.sony.net/resources/software/bravia-signage/https://pro.sony/ue_US/products/display-softwarehttps://www.vulncheck.com/advisories/sony-bravia-digital-signage-client-side-protection-bypass-via-idorhttps://www.zeroscience.mk/codes/sonybravia_idor.txthttps://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5611.php