PT-2021-22124 · Advantech · Advantech Webaccess/Scada

Peter Cheng · Published 2021-10-15 · Updated 2021-10-20 · CVE-2021-38431

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess SCADA versions 9.0.3 and prior

Description The issue allows an authenticated user to disclose project names and paths from other users using API functions.

Recommendations For Advantech WebAccess SCADA versions 9.0.3 and prior, consider restricting access to API functions until a patch is available. As a temporary workaround, limit the use of API functions that can disclose project names and paths to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-38431

Affected Products

Advantech Webaccess/Scada

References · 4

• https://osv.dev/vulnerability/CVE-2021-38431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38431 · Security Note
• https://t.me/cibsecurity/30610 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-21-285-01 · Note