PT-2014-1982 · Advantech · Advantech Webaccess

Ilya Karpov + 1 · Publicado 2014-12-15 · Atualizado 2016-01-20 · CVE-2015-3948

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors due to inadequate protection of the web page structure during authentication. The exploitation of this issue may enable a remote attacker to inject arbitrary web scripts or HTML code because of incorrect filtering of user-input data.

Recommendations For Advantech WebAccess versions prior to 8.1, update to version 8.1 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2017-02189

CVE-2015-3948

Produtos afetados

Advantech Webaccess

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-3948 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3948 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-3948;%20https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01;%20http://securitylab.ru/lab/PT-2016-02 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-02189 · Nota de Segurança