PT-2020-16349 · Touchbase.Ai · Touchbase.Ai

Woo0Ood · Published 2020-11-11 · Updated 2020-11-17 · CVE-2020-26220

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions toucbase.ai versions prior to 2.0

Description The issue allows anyone with access to uploaded images of other users to obtain geolocation, device, and software version data if this information is present in the image's exif data, due to the failure to strip exif data from images.

Recommendations For versions prior to 2.0, update to version 2.0 to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-26220

GHSA-HH6J-J73P-CP3H

Affected Products

Touchbase.Ai

References · 7

• https://github.com/puncsky/touchbase.ai/pull/400/commits/69de77b163f6debaeb3f8d1a85367310a40d196f · Patch
• https://osv.dev/vulnerability/CVE-2020-26220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26220 · Security Note
• https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-hh6j-j73p-cp3h · Note
• https://t.me/cibsecurity/16192 · Telegram Post
• https://t.me/cvenotify/5557 · Telegram Post
• https://t.me/cvenotify/5707 · Telegram Post