CVE-2020-36887
BaseFortify
Publication date: 2025-12-10
Last updated on: 2025-12-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| spinetix | fusion_digital_signage | to 3.4.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in SpinetiX Fusion Digital Signage 3.4.8 allows unauthenticated attackers to access the database backup directory via the /content/files/backups/ endpoint. By doing so, attackers can download sensitive backup files that contain user credentials and system information.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information such as user credentials and system details. This can result in unauthorized access to the system, potential data breaches, and further exploitation of the affected environment.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the /content/files/backups/ endpoint is accessible without authentication on your SpinetiX Fusion Digital Signage 3.4.8 system. For example, you can use a command like: curl -I http://<target-ip>/content/files/backups/ to see if the directory listing or backup files are accessible. Additionally, scanning your network for devices running SpinetiX Fusion Digital Signage 3.4.8 and testing access to this endpoint can help identify vulnerable systems.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /content/files/backups/ directory by implementing proper authentication and access controls, removing or securing backup files containing sensitive information, and updating or patching the SpinetiX Fusion Digital Signage software if a fix is available. Additionally, monitoring access logs for unauthorized access attempts to this endpoint is recommended.