CVE-2020-36917: falha de alta gravidade em Guangzhou Yeroo Tech Co., Ltd.
iDS6 DSSPro Digital Signage System 6.2 Cleartext Password Disclosure via Cookie
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.3%
iDS6 DSSPro Digital Signage System 6.2 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept authentication credentials through cleartext cookie transmission. Attackers can exploit the autoSave feature to capture user passwords during man-in-the-middle attacks on HTTP communications.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Guangzhou Yeroo Tech Co., Ltd. · iDS6 DSSPro Digital Signage SystemReferências
https://cxsecurity.com/issue/WLB-2020110023https://exchange.xforce.ibmcloud.com/vulnerabilities/191261https://packetstormsecurity.com/files/159915https://web.archive.org/web/20200919100215/http://www.yerootech.com/https://www.vulncheck.com/advisories/ids-dsspro-digital-signage-system-cleartext-password-disclosure-via-cookiehttps://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5605.php