PT-2020-16348 · Touchbase.Ai · Touchbase.Ai

Puncsky · Published 2020-11-11 · Updated 2020-11-17 · CVE-2020-26219

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions touchbase.ai versions prior to 2.0

Description The issue impacts touchbase.ai, allowing for Open Redirect attacks. These attacks can lead to theft of information and credentials, redirection to malicious websites with attacker-controlled content, and in some cases, even cause XSS attacks. Although Open Redirect might seem harmless, its impacts can be severe if exploitable.

Recommendations For versions prior to 2.0, update to version 2.0 to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable endpoints to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-26219

GHSA-6WCQ-7R33-GW8X

Affected Products

Touchbase.Ai

References · 6

• https://osv.dev/vulnerability/CVE-2020-26219 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26219 · Security Note
• https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-6wcq-7r33-gw8x · Note
• https://t.me/cvenotify/5706 · Telegram Post
• https://t.me/cibsecurity/16187 · Telegram Post
• https://t.me/cvenotify/5555 · Telegram Post