VulnerabilityModified
CVE-2020-26526
An issue was discovered in Damstra Smart Asset 2020.7.
MEDIUM 5.3EPSS 1.47%
Does this matter?
Lower severity and a low EPSS score (1.47%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid ("Unable to find an APIDomain" versus "Wrong email or password").
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.47% probability · 72th percentile
- CISA KEV
- Not listed
- Affected
- damstratechnology/smart asset
- Source
- cve@mitre.org
References
- https://github.com/lukaszstu/SmartAsset-UE-CVE-2020-26526Third Party Advisory
- https://smartasset.com/Vendor Advisory
- https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-PlatformVendor Advisory
- https://github.com/lukaszstu/SmartAsset-UE-CVE-2020-26526Third Party Advisory
- https://smartasset.com/Vendor Advisory
- https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-PlatformVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.