CVE-2020-26220 Information exposure in touchbase.ai
Attackers can access sensitive metadata like geolocation from uploaded images due to missing EXIF data stripping in touchbase.ai.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-26220?
CVE-2020-26220 is a low-severity vulnerability in puncsky touchbase.ai, published on 11 Nov 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain its geolocation, device, and software version data etc (if present. The issue is fixed in version 2.0.
Weakness: CWE-200
Which versions are affected by CVE-2020-26220?
It affects 1 product.
Products include Touchbase.ai Project Touchbase.ai.
How do I fix CVE-2020-26220?
No fix has been published for CVE-2020-26220 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-26220 being exploited?
There is no known exploitation of CVE-2020-26220 in the wild and no public exploit code.