CVE-2020-25400: 
vulnerability analysis and mitigation

Cross domain policies in Taskcafe Project Management tool before version 0.1.0 and 0.1.1 allows remote attackers to access sensitive data such as access token (NIST NVD, MITRE CVE). The vulnerability was discovered and recorded on September 14, 2020.

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Under CVSS v2.0, it received a base score of 5.0 (MEDIUM) with the vector (AV:N/AC:L/Au:N/C:P/I:N/A:N) (NIST NVD).

The vulnerability allows remote attackers to access sensitive data, specifically access tokens. This could potentially lead to unauthorized access to user accounts and sensitive information within the Taskcafe Project Management system (NIST NVD).

The vulnerability can be exploited remotely without requiring authentication or user interaction, making it relatively easy to exploit. The attack complexity is considered low according to the CVSS metrics (NIST NVD).

Users should upgrade to Taskcafe version 0.1.0 or later to address this vulnerability. The issue has been fixed in subsequent releases (NIST NVD, Taskcafe Repository).