CVE-2020-28861
MediumCVSS 5.3Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
In OpenAsset Digital Asset Management (DAM) version 12.0.19 and earlier, access controls are missing on the /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to access potentially sensitive project information stored by the application.
Risk Assessment
The organization is at risk of leaking confidential project data, which could be exploited by competitors or used for further attacks.
Recommendation
Immediately update OpenAsset DAM to a version later than 12.0.19 and implement proper access controls on the /Stream/ProjectsCSV endpoint.
Original NVD description (English source)
OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the application.