CVE-2014-0771: fallo en Advantech WebAccess
Advantech WebAccess File and Directory Information Exposure
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 1.4%
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named
“OpenUrlToBuffer.” This method takes a URL as a parameter and returns
its contents to the caller in JavaScript. The URLs are accessed in the
security context of the current browser session. The control does not
perform any URL validation and allows “file://” URLs that access the
local disk.
The method can be used to open a URL (including file URLs) and read
file URLs through JavaScript. This method could also be used to reach
any arbitrary URL to which the browser has access.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Productos afectados
Advantech · WebAccessCVEs relacionadas — Advantech WebAccess
En el mismo producto, de las más peligrosas a las menos.