CVE-2020-28860
HighCVSS 8.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user input, incorporating it into SQL queries, allowing authenticated blind SQL injection.
Risk Assessment
The risk involves potential unauthorized database access by an authenticated attacker, which could lead to sensitive data leakage or modification.
Recommendation
It is recommended to immediately update OpenAsset DAM to the latest available version and implement input validation and parameterized SQL queries.
Other vulnerabilities in OpenAsset Digital Asset Management
See all- CVE-2020-28859Medium
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user-supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting (XSS) attacks.
- CVE-2020-28858High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly verify whether a request to the application was intentionally made by the user, allowing cross-site request forgery (CSRF) attacks on all user functions.
- CVE-2020-28857Medium
OpenAsset Digital Asset Management (DAM) through version 12.0.19 fails to properly sanitize user-supplied input in multiple parameters and endpoints, allowing stored cross-site scripting (XSS) attacks.
- CVE-2020-28856High
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not correctly determine the originating IP address of HTTP requests, allowing attackers to spoof it using the X-Forwarded-For header, e.g., by supplying localhost address 127.0.0.1, effectively bypassing all IP-based access controls.
Original NVD description (English source)
OpenAssetDigital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input, incorporating it into its SQL queries, allowing for authenticated blind SQL injection.