CVE-2020-28857
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
OpenAsset Digital Asset Management (DAM) through version 12.0.19 fails to properly sanitize user-supplied input in multiple parameters and endpoints, allowing stored cross-site scripting (XSS) attacks.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft, data leakage, or account takeover.
Recommendation
Immediately update OpenAsset DAM to the latest available version and implement server-side input validation and sanitization.
Other vulnerabilities in OpenAsset Digital Asset Management
See all- CVE-2020-28860High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user input, incorporating it into SQL queries, allowing authenticated blind SQL injection.
- CVE-2020-28859Medium
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user-supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting (XSS) attacks.
- CVE-2020-28858High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly verify whether a request to the application was intentionally made by the user, allowing cross-site request forgery (CSRF) attacks on all user functions.
- CVE-2020-28856High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not correctly determine the originating IP address of HTTP requests, allowing attackers to spoof it using the X-Forwarded-For header, e.g., by supplying localhost address 127.0.0.1, effectively bypassing all IP-based access controls.
Original NVD description (English source)
OpenAsset Digital Asset Management (DAM) through 12.0.19, does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for stored cross-site scripting attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS