CVE-2020-26526 — MEDIUM (5.3)

Vulnerability Description

An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid ("Unable to find an APIDomain" versus "Wrong email or password").

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Damstratechnology	Smart Asset	2020.7

References

https://github.com/lukaszstu/SmartAsset-UE-CVE-2020-26526Third Party Advisory
https://smartasset.com/Vendor Advisory
https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsseVendor Advisory
https://github.com/lukaszstu/SmartAsset-UE-CVE-2020-26526Third Party Advisory
https://smartasset.com/Vendor Advisory
https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsseVendor Advisory

FAQ

What is CVE-2020-26526?

CVE-2020-26526 is a vulnerability with a CVSS score of 5.3 (MEDIUM). An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid tha...

How severe is CVE-2020-26526?

CVE-2020-26526 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-26526?

Check the references section above for vendor advisories and patch information. Affected products include: Damstratechnology Smart Asset.