CVE-2020-36924

Katalog CVE

CVSS 6.1 · Medium EPSS 0,54%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada sony bravia signage. Skor CVSS 3.1 6.1 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Sony BRAVIA Digital Signage 1.7.8 contains a remote file inclusion vulnerability that allows attackers to inject arbitrary client-side scripts through the content material URL parameter. Attackers can exploit this vulnerability to hijack user sessions, execute cross-site scripting code, and modify display content by manipulating the input material type.

Rincian

Terbit di NVD

6 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cxsecurity.com/issue/WLB-2020120030 advisory pihak ketiga
• https://exchange.xforce.ibmcloud.com/vulnerabilities/192605 advisory pihak ketiga
• https://packetstorm.news/files/id/160345 exploit · advisory pihak ketiga
• https://www.exploit-db.com/exploits/49186 exploit · advisory pihak ketiga · vdb entry
• https://www.vulncheck.com/advisories/sony-bravia-digital-signage-unauthenticated-remote-file-inclusion advisory pihak ketiga
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5612.php exploit · advisory pihak ketiga
• https://pro-bravia.sony.net product
• https://pro-bravia.sony.net/resources/software/bravia-signage/ product
• https://pro.sony/ue_US/products/display-software product