CVE-2020-36900

Description

All-Dynamics Digital Signage System 2.0.2 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft a malicious web page that automatically submits forms to create a new user with global administrative privileges when a logged-in user visits the page.

Weakness classification

• disclosure@vulncheck.com: CWE-352

Primary references

• disclosure@vulncheck.com — Product
• disclosure@vulncheck.com — Exploit, Third Party Advisory
• disclosure@vulncheck.com — Third Party Advisory
• disclosure@vulncheck.com — Exploit, Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory