PT-2020-17043 · Openasset · Openasset Digital Asset Management

Jack Misiura · Published 2020-12-14 · Updated 2020-12-15 · CVE-2020-28856

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenAsset Digital Asset Management (DAM) versions 12.0.19 and earlier

Description The issue allows attackers to spoof the HTTP request's originating IP address by using the X-Forwarded-For header, potentially bypassing IP address-based access controls. This can be achieved by supplying a localhost address, such as 127.0.0.1.

Recommendations For versions 12.0.19 and earlier, consider implementing additional access controls that are not solely based on IP addresses, such as authentication tokens or other forms of verification, until a patch is available. As a temporary workaround, restrict the use of the X-Forwarded-For header to minimize the risk of IP address spoofing.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2020-28856

Affected Products

Openasset Digital Asset Management

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-28856 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28856 · Vendor Advisory
• http://packetstormsecurity.com/files/160453/OpenAsset-Digital-Asset-Management-IP-Access-Control-Bypass.html · Note
• http://openasset.com · Note
• https://themissinglink.com.au/security-advisories-cve-2020-28856 · Note
• http://seclists.org/fulldisclosure/2020/Dec/17 · Note
• https://t.me/cibsecurity/20752 · Telegram Post