CVE-2020-26219 - Vulnerability Details - OpenCVE

touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The issue is fixed in version 2.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Touchbase.ai Project	Touchbase.ai

Configuration 1 [-]

cpe:2.3:a:touchbase.ai_project:touchbase.ai:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-6wcq-7r33-gw8x

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2020-11-11T22:05:15

Updated: 2024-08-04T15:49:07.257Z

Reserved: 2020-10-01T00:00:00

Link: CVE-2020-26219

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-11-11T22:15:10.993

Modified: 2024-11-21T05:19:33.883

Link: CVE-2020-26219

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "touchbase.ai", "vendor": "puncsky", "versions": [{"status": "affected", "version": "< 2.0"}]}], "descriptions": [{"lang": "en", "value": "touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The issue is fixed in version 2.0."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "description": "{\"CWE-601\":\"URL Redirection to Untrusted Site ('Open Redirect')\"}", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-11-11T22:05:15", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-6wcq-7r33-gw8x"}], "source": {"advisory": "GHSA-6wcq-7r33-gw8x", "discovery": "UNKNOWN"}, "title": "Open Redirect in touchbase.ai", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-26219", "STATE": "PUBLIC", "TITLE": "Open Redirect in touchbase.ai"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "touchbase.ai", "version": {"version_data": [{"version_value": "< 2.0"}]}}]}, "vendor_name": "puncsky"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The issue is fixed in version 2.0."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "{\"CWE-601\":\"URL Redirection to Untrusted Site ('Open Redirect')\"}"}]}]}, "references": {"reference_data": [{"name": "https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-6wcq-7r33-gw8x", "refsource": "CONFIRM", "url": "https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-6wcq-7r33-gw8x"}]}, "source": {"advisory": "GHSA-6wcq-7r33-gw8x", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T15:49:07.257Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-6wcq-7r33-gw8x"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-26219", "datePublished": "2020-11-11T22:05:15", "dateReserved": "2020-10-01T00:00:00", "dateUpdated": "2024-08-04T15:49:07.257Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:touchbase.ai_project:touchbase.ai:*:*:*:*:*:*:*:*", "matchCriteriaId": "30CC5E42-0D4C-45BD-B3FA-072DDE3FBA5D", "versionEndExcluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The issue is fixed in version 2.0."}, {"lang": "es", "value": "touchbase.ai anterior a versi\u00f3n 2.0 es vulnerable a un Redireccionamiento Abierto. Los impactos pueden ser muchos y var\u00edan desde el robo de informaci\u00f3n y credenciales hasta el redireccionamiento hacia sitios web maliciosos que contienen contenido controlado por atacantes, que en algunos casos incluso causan ataques de tipo XSS. Entonces, aunque un redireccionamiento abierto pueda parecer inofensivo al principio, los impactos pueden ser graves si puede aprovecharse. El problema es corregido en la versi\u00f3n 2.0"}], "id": "CVE-2020-26219", "lastModified": "2024-11-21T05:19:33.883", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-11T22:15:10.993", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-6wcq-7r33-gw8x"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-6wcq-7r33-gw8x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}