CVE-2020-28857

Stored cross-site scripting in OpenAsset Digital Asset Management by OpenAsset | The Missing Link

Discovered by Jack Misiura on behalf of The Missing Link Security

Vulnerability Details

Multiple stored cross-site scripting (XSS) vulnerabilities in the OpenAsset Digital Asset Management software allows remote attackers to inject arbitrary JavaScript or HTML to be rendered later by the application via:

  • System preferences
    • Project Code regex
    • User name regex
    • Password regex
    • All three description fields
    • First Album Name
    • Vision Items Per SOAP request
  • Categories description
  • Keywords, triggered on deletion attempt
  • Editing photographer name
  • Access token name
  • Web share name

Successful exploitation of this issue may allow an attacker to perform unauthorised actions in a user’s security context, when the said user visits the affected pages.

Affected Versions

Discovered in: 12.0.19 (Cloud) 11.2.1 (On-Premise)

Fixed Versions

Fixed in: 12.0.23 (Cloud) 11.4.10 (On-Premise)

Latest News