Description
Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can exploit the /messagebroker/amf endpoint to elevate privileges and take over user accounts by manipulating role settings without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| EIBIZ | i-Media Server Digital Signage | ≤ 3.8.0 | — |
References
- ExploitDB-48774 exploit
- Vulnerability Advisory vendor-advisory
- Reference technical-description
- VulnCheck Advisory: Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated Privilege Escalation third-party-advisory