VulnerabilityAnalyzed
CVE-2020-36923
Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls.
MEDIUM 6.9EPSS 0.95%
Does this matter?
Lower severity and a low EPSS score (0.95%). Track it; it rarely justifies an emergency change on its own.
Description
Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access restrictions.
- CVSS 4.0
- 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.95% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-639
- Affected
- sony/bravia signage
- Source
- disclosure@vulncheck.com
References
- https://cxsecurity.com/issue/WLB-2020120031Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/192607Third Party Advisory
- https://packetstormsecurity.com/files/160344Third Party Advisory
- https://pro-bravia.sony.netProduct
- https://pro-bravia.sony.net/resources/software/bravia-signage/Product
- https://pro.sony/ue_US/products/display-softwareProduct
- https://www.vulncheck.com/advisories/sony-bravia-digital-signage-client-side-protection-bypass-via-idorThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5611.phpExploit, Third Party Advisory
- https://www.zeroscience.mk/codes/sonybravia_idor.txtThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5611.phpExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.