CVE-2020-36896: QiHang Media Web Digital Signage 3.0.9 Cleartext Credentials Disclosure
QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login information through an unprotected XML file. Attackers can retrieve hardcoded admin credentials by requesting the '/xml/User/User.xml' file, enabling direct authentication bypass.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36896?
CVE-2020-36896 is considered a high-severity vulnerability due to the risk of unauthorized access to sensitive administrative credentials.
How do I fix CVE-2020-36896?
To mitigate CVE-2020-36896, ensure that access to any XML files containing sensitive information is restricted and implement proper authentication mechanisms.
What type of vulnerability is CVE-2020-36896?
CVE-2020-36896 is classified as a cleartext credentials vulnerability allowing exposure of hardcoded admin credentials.
Which software is affected by CVE-2020-36896?
CVE-2020-36896 specifically affects QiHang Media Web Digital Signage version 3.0.9.
Who can be impacted by CVE-2020-36896?
Unauthenticated attackers can exploit CVE-2020-36896 to gain access to administrative login information of the vulnerable software.