CVE-2020-36901

CVE-2020-36901 is a cross-site request forgery (CSRF) vulnerability, classified under CWE-352, affecting UBICOD Medivision Digital Signage version 1.5.1. The flaw resides in the /query/user/itSet endpoint, which lacks proper request validation, enabling attackers to create administrative user accounts with elevated privileges. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

Unauthenticated attackers can exploit this vulnerability by crafting a malicious web page that, when visited by a legitimate authenticated user, automatically submits a form to the vulnerable endpoint. This tricks the victim's browser into creating a new admin user account on the target system without the victim's knowledge or consent, requiring only user interaction such as visiting the attacker's page. Successful exploitation grants the attacker full administrative access, potentially allowing further compromise of the digital signage system.

Advisories from sources including VulnCheck, Zero Science (ZSL-2020-5574), and a proof-of-concept exploit on Exploit-DB (EDB-ID: 48694) document the issue, with the vendor site at medivision.co.kr listed as a reference. No specific patch or mitigation details are outlined in the available information.