IP access control bypass in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Discovered by Jack Misiura on behalf of The Missing Link Security

Vulnerability Details

The application does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For directive in the header. By supplying localhost address such as, attackers can effectively bypass all IP address based access controls configured for the software.

Affected Versions

Discovered in: 12.0.19 (Cloud) 11.2.1 (On-Premise)

Fixed Versions

Fixed in: 12.0.20 (Cloud) 11.4.10 (On-Premise)

Latest News