Insufficient Logging in Hyland OnBase Versions 16.0.2.83 to 20.3.10.1000
CVE-2020-25249

5.3MEDIUM

Key Information:

Vendor

Hyland

Status
Onbase
Vendor
CVE Published:
11 September 2020

What is CVE-2020-25249?

An insufficient logging vulnerability has been identified in various versions of Hyland OnBase. This issue arises because the server only logs activities when explicitly specified by the client application. This lack of comprehensive server-side logging can pose serious compliance concerns, particularly for organizations in regulated industries where additional logging is necessary to meet regulatory requirements. Organizations using affected versions should evaluate their current configurations and implement necessary changes to enhance logging practices.

References

https://seclists.org/fulldisclosure/2020/Sep/8
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.