CVE-2020-26527 Misconfiguration in n/a

Critical 9.8 Published 2 Oct 2020 Updated 4 Aug 2024

Damstra Smart Asset API allows cross-origin requests from any origin, potentially exposing sensitive data to malicious websites.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-26527?

CVE-2020-26527 is a critical vulnerability in n/a, published on 2 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origin: example.com' header and responding with 200 OK and a wildcard 'Access-Control-Allow-Origin: *' header.

Weakness: CWE-346

Which versions are affected by CVE-2020-26527?

It affects 1 product.

Products include Damstratechnology Smart Asset.

How do I fix CVE-2020-26527?

No fix has been published for CVE-2020-26527 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-26527 being exploited?

There is no known exploitation of CVE-2020-26527 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-5xmj-hp6w-j5r5.