PT-2020-17045 · Openasset · Openasset Digital Asset Management

Jack Misiura · Published 2020-12-14 · Updated 2020-12-15 · CVE-2020-28858

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenAsset Digital Asset Management (DAM) through 12.0.19

Description The issue allows for cross-site request forgery attacks on all user functions due to the application not correctly verifying whether a request was intentionally made by the user.

Recommendations For OpenAsset Digital Asset Management (DAM) through 12.0.19, update to a version later than 12.0.19 to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-28858

Affected Products

Openasset Digital Asset Management

References · 8

• 🔥 http://packetstormsecurity.com/files/160458/OpenAsset-Digital-Asset-Management-Cross-Site-Request-Forgery.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28858 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28858 · Vendor Advisory
• http://openasset.com · Note
• https://t.me/cvenotify/7079 · Telegram Post
• https://t.me/cibsecurity/20773 · Telegram Post
• http://seclists.org/fulldisclosure/2020/Dec/19 · Note
• https://themissinglink.com.au/security-advisories-cve-2020-28858 · Note