PT-2018-16960 · Advantech · Webaccess/Scada

Rgod · Publicado 2018-01-25 · Atualizado 2019-10-09 · CVE-2018-5443

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/SCADA versions prior to V8.2 20170817

Description A SQL Injection issue was discovered in the software. It does not properly sanitize its inputs for SQL commands, which can lead to information disclosure. The issue is related to the uMailLogin and chkLogin2 functions, where the user variable is vulnerable to SQL injection.

Recommendations For versions prior to V8.2 20170817, update to version V8.2 20170817 or later to resolve the issue. As a temporary workaround, consider restricting access to the uMailLogin and chkLogin2 functions to minimize the risk of exploitation. Avoid using the user variable in affected API endpoints until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-5443

ZDI-18-143

ZDI-18-144

Produtos afetados

Webaccess/Scada

Referências · 6

• https://zerodayinitiative.com/advisories/ZDI-18-144 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-5443 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-18-023-01 · Nota
• https://zerodayinitiative.com/advisories/ZDI-18-143 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-5443 · Nota de Segurança
• http://securityfocus.com/bid/102781 · Nota