PT-2025-50516 · Eibiz · Mediaserver

Published 2025-12-10 · Updated 2025-12-11 · CVE-2020-36895

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions EIBIZ i-Media Server Digital Signage version 3.8.0

Description The software contains an unauthenticated configuration disclosure issue. Remote attackers can access sensitive configuration files via direct object reference. Specifically, attackers can retrieve the SiteConfig.properties file using an HTTP GET request. This exposure includes administrative credentials, database connection details, and system configuration information.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2020-36895

Affected Products

Mediaserver

References · 8

• 🔥 https://exploit-db.com/exploits/48764 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5583.php · Exploit
• https://osv.dev/vulnerability/CVE-2020-36895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36895 · Security Note
• https://twitter.com/CVEnew/status/1999108932074418686 · Twitter Post
• https://vulncheck.com/advisories/eibiz-i-media-server-digital-signage-unauthenticated-configuration-disclosure · Note
• https://t.me/CVEtracker/39400 · Telegram Post
• http://eibiz.co.th · Note