high7.5
CVE-2020-36887
SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenticated information disclosure vulnerability in the database backup directory.
Impact
SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenticated information disclosure vulnerability in the database backup directory. Attackers can access the /content/files/backups/ endpoint to download sensitive backup files containing user credentials and system information.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Spinetix | Fusion Digital Signage | through 3.4.8 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.exploit-db.com/exploits/48845
- https://www.spinetix.com
- https://www.vulncheck.com/advisories/spinetix-fusion-digital-signage-unauthenticated-database-backup-disclosure
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5593.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5593.php