Skip to main content

Digital Asset Management CVE-2020-28856

HIGH
Authentication Bypass by Spoofing (CWE-290)
2020-12-14 cve@mitre.org
Authentication Bypass Digital Asset Management
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Dec 14, 2020 - 18:15 nvd
HIGH 7.5

DescriptionNVD

OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access controls.

AnalysisAI

OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-290. OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access controls. Affected products include: Openasset Digital Asset Management. Version information: through 12.0.19.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Digital Asset Management

View all
CVE-2020-28860 HIGH POC
8.8 Dec 14

OpenAssetDigital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input, incorporating i
CVE-2020-28858 HIGH POC
8.8 Dec 14

OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the applica
CVE-2020-28857 MEDIUM POC
6.1 Dec 14

OpenAsset Digital Asset Management (DAM) through 12.0.19, does not correctly sanitize user supplied input in multiple pa
CVE-2020-28861 MEDIUM POC
5.3 Dec 14

OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV

CVE-2020-28859 MEDIUM
6.1 Dec 14

OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input in multiple par

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all
CVE-2024-54085 CRITICAL
9.8
CVE-2023-50224 MEDIUM
6.5
CVE-2024-4358 CRITICAL POC
9.8
CVE-2018-5353 CRITICAL POC
9.8
CVE-2023-51350 CRITICAL POC
9.8
CVE-2022-3180 CRITICAL
9.8
CVE-2025-66570 CRITICAL POC
10.0
CVE-2025-49002 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2020-28856 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy