PT-2020-16035 · Hyland · Hyland Onbase

Published 2020-09-11 · Updated 2022-06-30 · CVE-2020-25249

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hyland OnBase versions 16.0.2.83 and below Hyland OnBase versions 17.0.2.109 and below Hyland OnBase versions 18.0.0.37 and below Hyland OnBase versions 19.8.16.1000 and below Hyland OnBase versions 20.3.10.1000 and below

Description An issue was discovered where the server typically logs activity only when a client application specifies that logging is desired. This can be problematic for use cases in a regulated industry, where server-side logging is required in additional situations.

Recommendations For Hyland OnBase versions 16.0.2.83 and below, consider configuring the server to log activity by default, regardless of client application specifications. For Hyland OnBase versions 17.0.2.109 and below, consider configuring the server to log activity by default, regardless of client application specifications. For Hyland OnBase versions 18.0.0.37 and below, consider configuring the server to log activity by default, regardless of client application specifications. For Hyland OnBase versions 19.8.16.1000 and below, consider configuring the server to log activity by default, regardless of client application specifications. For Hyland OnBase versions 20.3.10.1000 and below, consider configuring the server to log activity by default, regardless of client application specifications.

Fix

Related Identifiers

CVE-2020-25249

Affected Products

Hyland Onbase

References · 3

• https://osv.dev/vulnerability/CVE-2020-25249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25249 · Security Note
• https://seclists.org/fulldisclosure/2020/Sep/8 · Note