CVEvulnerability
CVE-2020-36893
8.7 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
Description
Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system files such as win.ini.
Affected configurations
• eibiz i-media server digital signage 3.8.0
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://www.eibiz.co.th Broken Link
- https://www.exploit-db.com/exploits/48766 Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/eibiz-i-media-server-digital-signage-directory-traversal-vulnerability Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5585.php Exploit, Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5585.php Exploit, Third Party Advisory