CVE-2017-20220

Published: Mar 16, 2026Modified: Apr 15, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication.

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (8)

http://www.securitylab.ru/poc/486047.php

Source: disclosure@vulncheck.com

https://blogs.securiteam.com/index.php/archives/3094

Source: disclosure@vulncheck.com

https://cxsecurity.com/issue/WLB-2017050025

Source: disclosure@vulncheck.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/125645

Source: disclosure@vulncheck.com

https://packetstormsecurity.com/files/142386

Source: disclosure@vulncheck.com

https://www.exploit-db.com/exploits/41960/

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/serviio-pro-unauthenticated-password-change-via-rest-api

Source: disclosure@vulncheck.com

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5407.php

Source: disclosure@vulncheck.com

Timeline

No history available yet.