CVE-2020-28408 : Security Advisory and Response

Dundas BI server through version 8.0.0.1001 is vulnerable to XSS attacks via an HTML label during dashboard creation or editing.

Understanding CVE-2020-28408

This CVE identifies a persistent XSS vulnerability in Dundas BI server.

What is CVE-2020-28408?

The server in Dundas BI through version 8.0.0.1001 is susceptible to cross-site scripting (XSS) attacks when manipulating dashboard elements.

The Impact of CVE-2020-28408

Exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a user's session, potentially leading to unauthorized actions or data theft.

Technical Details of CVE-2020-28408

This section provides technical insights into the vulnerability.

Vulnerability Description

The issue arises from inadequate input validation, enabling attackers to inject and execute arbitrary scripts through HTML labels.

Affected Systems and Versions

Product: Dundas BI
Versions affected: up to 8.0.0.1001

Exploitation Mechanism

Attackers can exploit this vulnerability by inserting malicious scripts into HTML labels while creating or editing dashboards.

Mitigation and Prevention

Protect your systems from CVE-2020-28408 with these security measures.

Immediate Steps to Take

Update Dundas BI to the latest version that includes a patch for this vulnerability.
Implement strict input validation mechanisms to prevent XSS attacks.

Long-Term Security Practices

Conduct regular security assessments and penetration testing to identify and address vulnerabilities.
Educate users on safe practices to mitigate the risk of XSS attacks.

Patching and Updates

Ensure timely installation of security patches and updates to safeguard against known vulnerabilities.