CVE-2020-36901
UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new admin user with elevated privileges.
- CVSS 4.0
- 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.31% probability · 24th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- medivision/medivision digital signage firmware
- Source
- disclosure@vulncheck.com
References
- http://www.medivision.co.krProduct
- https://www.exploit-db.com/exploits/48694Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/ubicod-medivision-digital-signage-cross-site-request-forgery-via-user-managementThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5574.phpExploit, Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5574.phpExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.