Description
iDS6 DSSPro Digital Signage System 6.2 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept authentication credentials through cleartext cookie transmission. Attackers can exploit the autoSave feature to capture user passwords during man-in-the-middle attacks on HTTP communications.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Guangzhou Yeroo Tech Co., Ltd. iDS6 DSSPro Digital Signage System
V6.2 B2014.12.12.1220affectedV5.6 B2017.07.12.1757affectedV4.3affected
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5605.php ↗
- https://packetstormsecurity.com/files/159915 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/191261 ↗
- https://cxsecurity.com/issue/WLB-2020110023 ↗
- https://web.archive.org/web/20200919100215/http://www.yerootech.com/ ↗
- https://www.vulncheck.com/advisories/ids-dsspro-digital-signage-system-cleartext-password-disclosure-via-cookie ↗