Description
SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing the server's error responses.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SpenetiX | Fusion Digital Signage | ≤ 3.4.8 | — |
References
- ExploitDB-48847 exploit
- Official Product Homepage product
- Vendor Security Advisory for ZSL-2020-5591 vendor-advisory vdb-entry
- VulnCheck Advisory: SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login Script third-party-advisory