CVE-2020-25252 Cross-site request forgery in n/a
Cross-site request forgery allows attackers to log in using default credentials and perform unauthorized actions in Hyland OnBase.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-25252?
CVE-2020-25252 is a high-severity vulnerability in n/a, published on 11 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Hyland OnBase through 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. CSRF can be used to log in a user, and then perform actions, because there are default credentials (the wstinol password for the manager or hsi account).
Weakness: CWE-352
Which versions are affected by CVE-2020-25252?
It affects 1 product.
Products include Hyland Onbase.
How do I fix CVE-2020-25252?
No fix has been published for CVE-2020-25252 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-25252 being exploited?
There is no known exploitation of CVE-2020-25252 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-p2x5-wwvc-277f.