What is CVE-2020-25252?

CVE-2020-25252 is a high-severity vulnerability in Hyland Onbase, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2020-09-11.

How severe is CVE-2020-25252?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2020-25252 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CSRF in Hyland Onbase

CVE-2020-25252

An issue was discovered in Hyland OnBase through 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. CSRF can be used to log in a user, and then perform actions, because there are default credentials (the wstinol password for the manager or hsi account).

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.005 (40.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Hyland Onbase
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

Public proof-of-concept exploits

404notf0und/CVE-Flow

References

cve@mitre.org (Mailing List, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-25252?: CVE-2020-25252 is a high-severity vulnerability in Hyland Onbase, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2020-09-11.
How severe is CVE-2020-25252?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2020-25252 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.