CVE-2020-28860

2020-12-1419:33:22

mitre

www.cve.org

openassetdigital asset management

user input

sql queries

blind sql injection

AI Score

9.1

Confidence

High

EPSS

0.023

Percentile

89.8%

JSON

OpenAssetDigital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input, incorporating it into its SQL queries, allowing for authenticated blind SQL injection.

References

openasset.com

packetstormsecurity.com/files/160459/OpenAsset-Digital-Asset-Management-SQL-Injection.html

seclists.org/fulldisclosure/2020/Dec/21

www.themissinglink.com.au/security-advisories-cve-2020-28860