CVE-2020-28858

Опубликовано: 14 дек. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user, allowing for cross-site request forgery attacks on all user functions.

Ссылки

http://packetstormsecurity.com/files/160458/OpenAsset-Digital-Asset-Management-Cross-Site-Request-Forgery.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/19
Mailing List
Third Party Advisory
https://www.themissinglink.com.au/security-advisories-cve-2020-28858
Third Party Advisory
http://packetstormsecurity.com/files/160458/OpenAsset-Digital-Asset-Management-Cross-Site-Request-Forgery.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/19
Mailing List
Third Party Advisory
https://www.themissinglink.com.au/security-advisories-cve-2020-28858
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:openasset:digital_asset_management:*:*:*:*:*:*:*:*

Версия до 12.0.19 (включая)

EPSS

Процентиль: 61%

0.01036

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-2rcf-f7rp-mvx7