PT-2014-1982 · Advantech · Advantech Webaccess

Ilya Karpov + 1 · Published 2014-12-15 · Updated 2016-01-20 · CVE-2015-3948

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors due to inadequate protection of the web page structure during authentication. The exploitation of this issue may enable a remote attacker to inject arbitrary web scripts or HTML code because of incorrect filtering of user-input data.

Recommendations For Advantech WebAccess versions prior to 8.1, update to version 8.1 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2017-02189

CVE-2015-3948

Affected Products

Advantech Webaccess

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-3948 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-3948;%20https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01;%20http://securitylab.ru/lab/PT-2016-02 · Security Note
• https://bdu.fstec.ru/vul/2017-02189 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3948 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 · Note