PT-2018-18103 · Advantech · Advantech Webaccess Dashboard+3

Publicado 2018-05-15 · Atualizado 2019-10-09 · CVE-2018-7495

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions V8.2 20170817 and prior Advantech WebAccess versions V8.3.0 and prior Advantech WebAccess Dashboard versions V.2.0.15 and prior Advantech WebAccess Scada Node versions prior to 8.3.1 Advantech WebAccess/NMS versions 2.0.3 and prior

Description An external control of file name or path issue has been identified, which may allow an attacker to delete files. This issue affects various versions of Advantech WebAccess and related products.

Recommendations For Advantech WebAccess versions V8.2 20170817 and prior, update to a version later than V8.2 20170817. For Advantech WebAccess versions V8.3.0 and prior, update to a version later than V8.3.0. For Advantech WebAccess Dashboard versions V.2.0.15 and prior, update to a version later than V.2.0.15. For Advantech WebAccess Scada Node versions prior to 8.3.1, update to version 8.3.1 or later. For Advantech WebAccess/NMS versions 2.0.3 and prior, update to a version later than 2.0.3.

Correção

Path traversal

Enumeração de Fraquezas

CWE-73

CWE-22

Identificadores relacionados

CVE-2018-7495

ZDI-18-499

Produtos afetados

Advantech Webaccess

Advantech Webaccess Dashboard

Advantech Webaccess Scada Node

Advantech Webaccess/Nms

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-7495 · Nota de Segurança
• http://securityfocus.com/bid/104190 · Nota
• https://zerodayinitiative.com/advisories/ZDI-18-499 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01 · Nota
• https://osv.dev/vulnerability/CVE-2018-7495 · Aviso do Fabricante