Unscored CVE-2020-28858 EUVD-2020-21250GHSA-2rcf-f7rp-mvx7

OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the application was intentiona…

Published Dec 14, 2020 · Updated Jul 9, 2026 · Assigned by mitre

Description

OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user, allowing for cross-site request forgery attacks on all user functions.

References

20201211 Cross-site request forgery (CSRF) in OpenAsset Digital Asset Management 11.2.1/12.0.19 disclosure mailing-list
http://packetstormsecurity.com/files/160458/OpenAsset-Digital-Asset-Management-Cross-Site-Request-Forgery.html
https://www.themissinglink.com.au/security-advisories-cve-2020-28858