HIGH🇬🇧 English

CVE-2020-36898

CVSS 8.8v4.0pub. 2025-12-10upd. 2025-12-17

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to delete arbitrary files with web server permissions using directory traversal sequences.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Howfor Qihang Media Web Digital Signage

    APP
    Howfor
    3.0.9
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Path Traversal
CWE
Referencje

Powiązane podatności

CVE-2020-36897CRITICAL9.3PL ✓ten sam produkt

RCE bez uwierzytelnienia w Qihang Media Web Digital Signage 3.0.9

CVE-2020-36896HIGH8.7ten sam produkt

QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthentica...

CVE-2020-36899HIGH8.7ten sam produkt

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows r...