PT-2019-16794 · Advantech · Webaccess

Publicado 2019-04-09 · Atualizado 2019-10-09 · CVE-2019-3940

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech WebAccess version 8.3.4

Description The issue allows an unauthenticated, remote attacker to execute arbitrary code via file upload attacks using an unauthenticated RPC call.

Recommendations For Advantech WebAccess version 8.3.4, consider restricting access to the RPC call to prevent unauthenticated file uploads until a patch is available.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-3940

Produtos afetados

Webaccess

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-3940 · Nota de Segurança
• http://securityfocus.com/bid/107847 · Nota
• https://tenable.com/security/research/tra-2019-15 · Nota
• https://osv.dev/vulnerability/CVE-2019-3940 · Aviso do Fabricante