PT-2018-9980 · Advantech · Advantech Webaccess Dashboard+3

Publicado 2018-05-15 · Atualizado 2019-10-09 · CVE-2018-10589

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess versions V8.2 20170817 and prior Advantech WebAccess versions V8.3.0 and prior Advantech WebAccess Dashboard versions V.2.0.15 and prior Advantech WebAccess Scada Node versions prior to 8.3.1 Advantech WebAccess/NMS versions 2.0.3 and prior

Description: A path traversal vulnerability has been identified, which may allow an attacker to execute arbitrary code.

Recommendations: For Advantech WebAccess versions V8.2 20170817 and prior, update to a version later than V8.2 20170817. For Advantech WebAccess versions V8.3.0 and prior, update to a version later than V8.3.0. For Advantech WebAccess Dashboard versions V.2.0.15 and prior, update to a version later than V.2.0.15. For Advantech WebAccess Scada Node versions prior to 8.3.1, update to version 8.3.1 or later. For Advantech WebAccess/NMS versions 2.0.3 and prior, update to a version later than 2.0.3.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-10589

ZDI-18-483

Produtos afetados

Advantech Webaccess

Advantech Webaccess Dashboard

Advantech Webaccess Scada Node

Advantech Webaccess/Nms

Referências · 5

• https://zerodayinitiative.com/advisories/ZDI-18-483 · Nota de Segurança
• http://securityfocus.com/bid/104190 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-10589 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-10589 · Aviso do Fabricante