Sony BRAVIA Digital Signage 1.7.8 contains a remote file inclusion vulnerability that allows attackers to inject arbitrary client-side scripts through the content material URL parameter. Attackers can exploit this vulnerability to hijack user sessions, execute cross-site scripting code, and modify display content by manipulating the input material type.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Sony Bravia_Signage
cpe:2.3:a:sony:bravia_signage:*:*:*:*:*:*:*:*
|
— |
<= 1.7.8
|
References 9
https://cxsecurity.com/issue/WLB-2020120030
disclosure@vulncheck.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/192605
disclosure@vulncheck.com
https://packetstorm.news/files/id/160345
disclosure@vulncheck.com
https://pro-bravia.sony.net
disclosure@vulncheck.com
https://pro-bravia.sony.net/resources/software/bravia-signage/
disclosure@vulncheck.com
https://pro.sony/ue_US/products/display-software
disclosure@vulncheck.com
https://www.exploit-db.com/exploits/49186
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/sony-bravia-digital-signage-unauthenticate…
disclosure@vulncheck.com
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5612.php
disclosure@vulncheck.com