PT-2019-3566 · Advantech · Webaccess

Mat Powell · Published 2019-06-27 · Updated 2023-03-02 · CVE-2019-10985

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.5 and prior

Description The issue is caused by a lack of proper validation of a user-supplied path prior to use in file operations, allowing an attacker to delete files while posing as an administrator. This can be exploited by a remote attacker to delete files.

Recommendations For versions 8.3.5 and prior, consider restricting access to file operations until a patch is available. As a temporary workaround, limit the privileges of users who can perform file operations to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-03767

CVE-2019-10985

ZDI-19-622

Affected Products

Webaccess

References · 6

• https://zerodayinitiative.com/advisories/ZDI-19-622 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10985 · Security Note
• https://bdu.fstec.ru/vul/2019-03767 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10985 · Vendor Advisory
• https://securitylab.ru/news/499681.php · Note
• https://us-cert.gov/ics/advisories/icsa-19-178-05 · Note