CVE-2020-26525 - Vulnerability Details - OpenCVE

Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Damstratechnology	Smart Asset

Configuration 1 [-]

cpe:2.3:a:damstratechnology:smart_asset:2020.7:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/lukaszstu/SmartAsset-SQLinj-CVE-2020-26525/blob/main/README.md
https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-Platform
https://www.smartasset.com.au/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-10-02T19:47:52

Updated: 2024-08-04T15:56:04.571Z

Reserved: 2020-10-02T00:00:00

Link: CVE-2020-26525

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-10-02T20:15:13.127

Modified: 2024-11-21T05:20:01.017

Link: CVE-2020-26525

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-10-02T19:47:52", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.smartasset.com.au/"}, {"tags": ["x_refsource_MISC"], "url": "https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-Platform"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/lukaszstu/SmartAsset-SQLinj-CVE-2020-26525/blob/main/README.md"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2020-26525", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.smartasset.com.au/", "refsource": "MISC", "url": "https://www.smartasset.com.au/"}, {"name": "https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-Platform", "refsource": "MISC", "url": "https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-Platform"}, {"name": "https://github.com/lukaszstu/SmartAsset-SQLinj-CVE-2020-26525/blob/main/README.md", "refsource": "MISC", "url": "https://github.com/lukaszstu/SmartAsset-SQLinj-CVE-2020-26525/blob/main/README.md"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T15:56:04.571Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.smartasset.com.au/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-Platform"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/lukaszstu/SmartAsset-SQLinj-CVE-2020-26525/blob/main/README.md"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-26525", "datePublished": "2020-10-02T19:47:52", "dateReserved": "2020-10-02T00:00:00", "dateUpdated": "2024-08-04T15:56:04.571Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:damstratechnology:smart_asset:2020.7:*:*:*:*:*:*:*", "matchCriteriaId": "BB0C9567-ED1F-42EE-8ED5-87BD3A8B8E19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers."}, {"lang": "es", "value": "Damstra Smart Asset versi\u00f3n 2020.7, presenta una inyecci\u00f3n SQL por medio del par\u00e1metro originator de API/api/Asset. Esto permite forzar a la base de datos y al servidor para iniciar conexiones remotas a servidores DNS de terceros"}], "id": "CVE-2020-26525", "lastModified": "2024-11-21T05:20:01.017", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "[email protected]", "type": "Primary"}]}, "published": "2020-10-02T20:15:13.127", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/lukaszstu/SmartAsset-SQLinj-CVE-2020-26525/blob/main/README.md"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-Platform"}, {"source": "[email protected]", "tags": ["Product", "Vendor Advisory"], "url": "https://www.smartasset.com.au/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/lukaszstu/SmartAsset-SQLinj-CVE-2020-26525/blob/main/README.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-Platform"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Vendor Advisory"], "url": "https://www.smartasset.com.au/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "[email protected]", "type": "Primary"}]}