CVE-2020-28859

MediumCVSS 6.1

Published: 14/12/2020(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.77%

51th percentile - higher than 51% of all known CVEs

Summary

OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user-supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting (XSS) attacks.

Risk Assessment

An attacker can inject malicious JavaScript code into a page that executes in the victim's browser, potentially leading to session theft, redirection to malicious sites, or theft of sensitive data.

Recommendation

Immediately upgrade OpenAsset DAM to a version later than 12.0.19 that includes security fixes, and implement server-side input validation and sanitization.

Original NVD description (English source)

OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks.