CVE-2020-37228
CRITICALiDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2020-37228. PoCs published by LiquidWorm.
AI-analyzed exploit summary The exploit demonstrates a CAPTCHA bypass vulnerability in iDS6 DSSPro Digital Signage System 6.2 by requesting the autoLoginVerifyCode object to obtain a JSON message code, which can then be used to bypass CAPTCHA authentication and perform brute-force attacks.
Description
iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode object. Attackers can retrieve valid CAPTCHA codes via the login endpoint and use them to perform brute-force attacks against user accounts.
Exploits (1)
The exploit demonstrates a CAPTCHA bypass vulnerability in iDS6 DSSPro Digital Signage System 6.2 by requesting the autoLoginVerifyCode object to obtain a JSON message code, which can then be used to bypass CAPTCHA authentication and perform brute-force attacks.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H