CVE-2020-28858
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly verify whether a request to the application was intentionally made by the user, allowing cross-site request forgery (CSRF) attacks on all user functions.
Risk Assessment
A CSRF attack could allow an attacker to perform unauthorized actions on behalf of an authenticated user, such as modifying data, deleting assets, or changing configuration, leading to integrity and confidentiality breaches.
Recommendation
Immediately upgrade OpenAsset DAM to a version newer than 12.0.19 that includes a fix for the CSRF vulnerability. If an upgrade is not possible, implement additional protections such as CSRF tokens or Origin header validation.
Other vulnerabilities in OpenAsset Digital Asset Management
See all- CVE-2020-28860High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user input, incorporating it into SQL queries, allowing authenticated blind SQL injection.
- CVE-2020-28859Medium
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user-supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting (XSS) attacks.
- CVE-2020-28857Medium
OpenAsset Digital Asset Management (DAM) through version 12.0.19 fails to properly sanitize user-supplied input in multiple parameters and endpoints, allowing stored cross-site scripting (XSS) attacks.
- CVE-2020-28856High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not correctly determine the originating IP address of HTTP requests, allowing attackers to spoof it using the X-Forwarded-For header, e.g., by supplying localhost address 127.0.0.1, effectively bypassing all IP-based access controls.
Original NVD description (English source)
OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user, allowing for cross-site request forgery attacks on all user functions.