CVEvulnerability
CVE-2020-36920
8.7 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-01-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-863
Description
iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console JavaScript functions. Attackers can create users, modify roles and permissions, and potentially achieve full application takeover by exploiting insecure direct object references.
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://cxsecurity.com/issue/WLB-2020110025 cxsecurity.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/191260 exchange.xforce.ibmcloud.com
- https://packetstorm.news/files/id/159918 packetstorm.news
- https://web.archive.org/web/20200919100215/http://www.yerootech.com/ web.archive.org
- https://www.exploit-db.com/exploits/48992 www.exploit-db.com
- https://www.vulncheck.com/advisories/ids-dsspro-digital-signage-system-privilege-escalation-via-access-control www.vulncheck.com
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5608.php www.zeroscience.mk
- https://www.exploit-db.com/exploits/48992 www.exploit-db.com