CVE-2020-36920
iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console JavaScript functions.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console JavaScript functions. Attackers can create users, modify roles and permissions, and potentially achieve full application takeover by exploiting insecure direct object references.
- CVSS 4.0
- 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.36% probability · 29th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Source
- disclosure@vulncheck.com
References
- https://cxsecurity.com/issue/WLB-2020110025
- https://exchange.xforce.ibmcloud.com/vulnerabilities/191260
- https://packetstorm.news/files/id/159918
- https://web.archive.org/web/20200919100215/http://www.yerootech.com/
- https://www.exploit-db.com/exploits/48992
- https://www.vulncheck.com/advisories/ids-dsspro-digital-signage-system-privilege-escalation-via-access-control
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5608.php
- https://www.exploit-db.com/exploits/48992
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.