PT-2018-3084 · Advantech · Advantech Webaccess

Publicado 2018-10-31 · Atualizado 2019-01-30 · CVE-2018-15706

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.1 through 8.3.2

Description The issue concerns a directory traversal vulnerability in the readFile API of the WADashboard component. This vulnerability allows remote authenticated attackers to read any file on the filesystem due to insufficient path validation in file operations.

Recommendations For Advantech WebAccess versions 8.3.1 and 8.3.2, consider restricting access to the readFile API until a patch is available. As a temporary workaround, limit the use of the WADashboard API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2019-03769

CVE-2018-15706

Produtos afetados

Advantech Webaccess

Referências · 5

• 🔥 https://tenable.com/security/research/tra-2018-35 · Exploit
• https://osv.dev/vulnerability/CVE-2018-15706 · Aviso do Fabricante
• https://cxsecurity.com/cveshow/CVE-2018-15706 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15706 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-03769 · Nota de Segurança