/Vulnerability Library

BrightSign Digital Signage 8.2.26 - Server-Side Request Forgery

CVE-2020-36884
Verified

Description

Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the BrightSign digital signage media player affecting the Diagnostic Web Server (DWS). The application parses user supplied data in the 'url' GET parameter to construct a diagnostics request to the Download Speed Test service.

Severity

Medium

Exploit Probability

1%

Published Date

August 31, 2022

Template Author

0x_akoko

CVE-2020-36884.yaml
5.0Severity

CVSS Metrics

CVE ID:
cve-2020-36884
CWE ID:
cwe-918

References

https://brightsign.zendesk.com/hc/en-us/articles/360056180694-Regarding-Advisory-ID-ZSL-2020-5595https://www.zeroscience.mk/codes/brightsign_ssrf.txthttps://nvd.nist.gov/vuln/detail/CVE-2020-36884

Remediation Steps

Update to a version later than 8.2.26 or the latest available version.