Vulnerability Details CVE-2020-28856
OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access controls.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 73.8%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- http://openasset.com
- http://packetstormsecurity.com/files/160453/OpenAsset-Digital-Asset-Management-IP-Access-Control-Bypass.html
- http://seclists.org/fulldisclosure/2020/Dec/17
- https://www.themissinglink.com.au/security-advisories-cve-2020-28856
- http://openasset.com
- http://packetstormsecurity.com/files/160453/OpenAsset-Digital-Asset-Management-IP-Access-Control-Bypass.html
- http://seclists.org/fulldisclosure/2020/Dec/17
- https://www.themissinglink.com.au/security-advisories-cve-2020-28856
Products affected by CVE-2020-28856
-
cpe:2.3:a:openasset:digital_asset_management:*