LiveActive security incident?Get immediate response
CVE Record

CVE-2020-28054: JamoDat TSMManager Collector version up to 6.5.0.21 is vulnerable to an Authorization Bypass because the Co...

JamoDat TSMManager Collector version up to 6.5.0.21 is vulnerable to an Authorization Bypass because the Collector component is not properly validating an authenticated session with the Viewer. If the Viewer has been modified (binary patched) and the Bypass Login functionality is being used, an attacker can request every Collector's functionality as if they were a properly logged-in user: administrating connected instances, reviewing logs, editing configurations, accessing the instances' consoles, accessing hardware configurations, etc.Exploiting this vulnerability won't grant an attacker access nor control on remote ISP servers as no credentials is sent with the request.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2020-28054 is an authorization bypass in JamoDat TSMManager Collector up to version 6.5.0.21. A modified Viewer using Bypass Login can make the Collector treat the user as logged in, enabling administrative actions inside Collector-managed functions. The source says this does not give direct access or control over remote ISP servers.

Executive priority

Prioritize if TSMManager supports operational backup, storage, or infrastructure administration. The business risk is unauthorized management activity inside Collector-controlled functions, but source evidence does not show remote ISP server takeover or active exploitation.

Technical view

The Collector does not properly validate an authenticated session with the Viewer. When a binary-patched Viewer uses Bypass Login, requests to Collector functionality can be accepted as if authenticated, including instance administration, logs, configurations, consoles, and hardware configuration views. Public sources provide no CVSS score, CWE, patch version, or confirmed exploitation.

Likely exposure

Exposure is limited to environments running JamoDat TSMManager Collector up to 6.5.0.21. Risk is higher where Viewer binaries can be modified, Bypass Login is used, or Collector interfaces are reachable by users outside trusted administration paths.

Exploitation context

The CVE describes a specific bypass condition involving a modified Viewer and Bypass Login. The bundle does not cite CISA KEV listing, active exploitation, public exploit use, or mass scanning. Treat exploitation status as unconfirmed from the provided evidence.

Researcher notes

Evidence is sparse: no CVSS, CWE, CPE, patch reference, or exploit-status confirmation is present in the bundle. The key technical condition is weak Collector session validation against Viewer state, with impact constrained by the CVE statement about no credentials being sent to remote ISP servers.

Mitigation direction

  • Identify all TSMManager Collector deployments and versions.
  • Check vendor guidance for fixed versions or supported mitigations.
  • Avoid modified Viewer binaries and Bypass Login use.
  • Restrict Collector access to trusted administrative networks or VPN.
  • Review administrative access controls around TSMManager systems.

Validation and detection

  • Confirm whether Collector version is 6.5.0.21 or earlier.
  • Check whether any Viewer binaries are modified or unsupported.
  • Review Collector logs for unexpected administrative activity.
  • Verify Collector endpoints are not broadly reachable.
  • Confirm vendor documentation for current remediation guidance.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Privilege behavior lookup

The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-28054 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.