CVE-2020-28859

Vulnerability

OpenAsset Digital Asset Management (DAM) through version 12.0.19 (Cloud) and 11.2.1 (On-Premise) fails to properly sanitize user-supplied input in several endpoints, leading to reflected cross-site scripting (XSS) vulnerabilities. The affected parameters include the email parameter on the account recovery/password reset page, the id parameter on saved search requests, and both the imageViewId and lpFilterInputId parameters on search result requests [2].

Exploitation

An attacker can exploit these vulnerabilities by crafting a malicious URL containing injected JavaScript or HTML. No authentication is required; the attacker only needs to trick a logged-in user into clicking the crafted link. The XSS payload executes in the context of the victim's browser, allowing the attacker to perform actions as the user [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript or HTML in the security context of the affected user. This can lead to session theft, unauthorized actions on behalf of the user, or defacement of the application interface [2].

Mitigation

Users should upgrade to the fixed versions: 12.0.22 (Cloud) or 11.4.10 (On-Premise) [2]. There are no workarounds mentioned; upgrading is the recommended action.