CVE-2020-36876
ReQuest Serious Play F3 Media Server <= 7.0.3 Debug Log Disclosure2020
- State
- Published
- Severity
- 8.7 High
- Published
- Dec 5, 2025
- Updated
- Jul 28, 2026
- Reserved
- Dec 5, 2025
Description
ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 allows unauthenticated attackers to disclose the webserver's Python debug log file containing system information, credentials, paths, processes and command arguments running on the device. Attackers can access sensitive information by visiting the message_log page.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-532 Insertion of Sensitive Information into Log File
Affected Products
| Product | Versions |
|---|---|
ReQuest Serious Play ProReQuest Serious Play LLC |
|
ReQuest Serious PlayReQuest Serious Play LLC |
|
References
- Exploit Database Entry 48950exploit
- Software Linkproduct
- Advisory URLvendor-advisory
- https://www.vulncheck.com/advisories/request-serious-play-f-media-server-debug-log-disclosurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.