What is CVE-2020-26220?

CVE-2020-26220 is a low-severity vulnerability in Puncsky Touchbase.ai, classified under Information Disclosure. CVSS score: 3.5/10. Published 2020-11-11.

How severe is CVE-2020-26220?

Low severity. CVSS v3 base score is 3.5 out of 10.

Information disclosure in Puncsky Touchbase.ai

CVE-2020-26220

toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain its geolocation, device, and software version data etc (if present. The issue is fixed in version 2.0.

Vulnerability class: Information Disclosure

EPSS: 0.007 (51.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N.

Affected products

Puncsky Touchbase.ai — versions < 2.0
Touchbase.ai_project Touchbase.ai

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-26220?: CVE-2020-26220 is a low-severity vulnerability in Puncsky Touchbase.ai, classified under Information Disclosure. CVSS score: 3.5/10. Published 2020-11-11.
How severe is CVE-2020-26220?: Low severity. CVSS v3 base score is 3.5 out of 10.