CVE-2020-36892
CriticalSummary
Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can exploit the /messagebroker/amf endpoint to elevate privileges and take over user accounts by manipulating role settings without authentication.
Risk Assessment
The risk to the organization is unauthorized takeover of administrator accounts and full system control, potentially leading to data security breaches.
Recommendation
It is recommended to immediately update the software and enforce authentication for all endpoints, especially /messagebroker/amf.
Original NVD description (English source)
Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can exploit the /messagebroker/amf endpoint to elevate privileges and take over user accounts by manipulating role settings without authentication.