HIGH🇬🇧 English

CVE-2020-36899

CVSS 8.7v4.0pub. 2025-12-10upd. 2025-12-17

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive files through unverified 'filename' and 'path' parameters. Attackers can exploit the QH.aspx endpoint to read arbitrary files and directory contents without authentication by manipulating download and getAll actions.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Howfor Qihang Media Web Digital Signage

    APP
    Howfor
    3.0.9
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2020-36897CRITICAL9.3PL ✓ten sam produkt

RCE bez uwierzytelnienia w Qihang Media Web Digital Signage 3.0.9

CVE-2020-36896HIGH8.7ten sam produkt

QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthentica...

CVE-2020-36898HIGH8.8ten sam produkt

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx ...