PT-2018-3084 · Advantech · Advantech Webaccess

Published 2018-10-31 · Updated 2019-01-30 · CVE-2018-15706

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.1 through 8.3.2

Description The issue concerns a directory traversal vulnerability in the readFile API of the WADashboard component. This vulnerability allows remote authenticated attackers to read any file on the filesystem due to insufficient path validation in file operations.

Recommendations For Advantech WebAccess versions 8.3.1 and 8.3.2, consider restricting access to the readFile API until a patch is available. As a temporary workaround, limit the use of the WADashboard API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-03769

CVE-2018-15706

Affected Products

Advantech Webaccess

References · 5

• 🔥 https://tenable.com/security/research/tra-2018-35 · Exploit
• https://osv.dev/vulnerability/CVE-2018-15706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15706 · Security Note
• https://bdu.fstec.ru/vul/2019-03769 · Security Note
• https://cxsecurity.com/cveshow/CVE-2018-15706 · Note