CVE-2020-36895 HIGH

CVE-2020-36895: EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure

Vendor Eibiz Co.,Ltd.
Product i-Media Server Digital Signage
Weakness CWE-639 · IDOR
Published December 10, 2025
Last update December 11, 2025
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive configuration files via direct object reference. Attackers can retrieve the SiteConfig.properties file through an HTTP GET request, exposing administrative credentials, database connection details, and system configuration information.

Key dates

02Disclosure timeline

December 10, 2025 CVE published
December 11, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-34046 Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check CVE-2025-62242 CVE-2026-2879 GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion CVE-2025-0640 IDOR in Akinsoft's OctoCloud CVE-2026-3454 GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements