PT-2020-12485 · Oasis · Oasis

Christian Bundy · Published 2020-04-14 · Updated 2020-04-16 · CVE-2020-11003

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Oasis versions prior to 2.15.0

Description The issue concerns a potential DNS rebinding or CSRF vulnerability. If an attacker can trick a user into visiting a malicious website, they could use DNS rebinding and CSRF attacks to read or write to vulnerable applications. There is no evidence that suggests this has been used in the wild.

Recommendations For Oasis versions prior to 2.15.0, update to version 2.15.0 to resolve the issue. As a temporary workaround, consider avoiding visits to potentially malicious websites to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-11003

GHSA-J438-45HC-VJHM

Affected Products

Oasis

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-11003 · Security Note
• https://osv.dev/vulnerability/GHSA-j438-45hc-vjhm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11003 · Vendor Advisory
• https://github.com/fraction/oasis/security/advisories/GHSA-j438-45hc-vjhm · Note
• https://t.me/cvenotify/2735 · Telegram Post