CVE-2020-36899: QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Disclosure
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive files through unverified 'filename' and 'path' parameters. Attackers can exploit the QH.aspx endpoint to read arbitrary files and directory contents without authentication by manipulating download and getAll actions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36899?
CVE-2020-36899 has a medium severity level due to its ability to allow unauthorized access to sensitive files.
How do I fix CVE-2020-36899?
To fix CVE-2020-36899, validate and sanitize the 'filename' and 'path' parameters before processing them in the QH.aspx endpoint.
What types of files can be accessed due to CVE-2020-36899?
CVE-2020-36899 allows attackers to read arbitrary files on the server, potentially exposing sensitive information.
Which software products are affected by CVE-2020-36899?
CVE-2020-36899 affects QiHang Media Web Digital Signage version 3.0.9.
Is authentication required to exploit CVE-2020-36899?
No, CVE-2020-36899 is an unauthenticated vulnerability, allowing attackers to exploit it without needing to log in.