CVE-2020-25256: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below

Critical severity · published Sep 11, 2020

CVE-2020-25256

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below

9.1

CVSS

0.6%

EPSS

On KEV

Description

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. PKI certificates have a private key that is the same across different customers' installations.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.6% · higher than 50% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Onbase · Hyland

through 16.0.2.83; 17.0.0.0 through 17.0.2.109; 18.0.0.0 through 18.0.0.37; 19.0.0.0 through 19.8.16.1000; 20.0.0.0 through 20.3.10.1000 · source: NVD

Affected product

Onbase

Hyland

All Onbase CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-25256

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-25256

Mailing List

https://seclists.org/fulldisclosure/2020/Sep/18