CVE-2020-28859
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user-supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting (XSS) attacks.
Risk Assessment
An attacker can inject malicious JavaScript code into a page that executes in the victim's browser, potentially leading to session theft, redirection to malicious sites, or theft of sensitive data.
Recommendation
Immediately upgrade OpenAsset DAM to a version later than 12.0.19 that includes security fixes, and implement server-side input validation and sanitization.
Other vulnerabilities in OpenAsset Digital Asset Management
See all- CVE-2020-28860High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user input, incorporating it into SQL queries, allowing authenticated blind SQL injection.
- CVE-2020-28858High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly verify whether a request to the application was intentionally made by the user, allowing cross-site request forgery (CSRF) attacks on all user functions.
- CVE-2020-28857Medium
OpenAsset Digital Asset Management (DAM) through version 12.0.19 fails to properly sanitize user-supplied input in multiple parameters and endpoints, allowing stored cross-site scripting (XSS) attacks.
- CVE-2020-28856High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not correctly determine the originating IP address of HTTP requests, allowing attackers to spoof it using the X-Forwarded-For header, e.g., by supplying localhost address 127.0.0.1, effectively bypassing all IP-based access controls.
Original NVD description (English source)
OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS