var-201407-0234
Vulnerability from variot
Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gmicons.asp functionality. An attacker may leverage this to run arbitrary code in the context of the WebAccess service. WebAccess HMI/SCADA software provides remote control and management, allowing users to easily view and configure automation equipment in facility management systems, power stations and building automation systems. Advantech WebAccess is prone to a remote code-execution vulnerability. Failed exploit attempts will likely cause a denial-of-service condition. Advantech WebAccess 7.1 and prior are vulnerable. Advantech WebAccess is a browser-based HMI/SCADA software developed by Advantech. There are security vulnerabilities in Advantech WebAccess 7.1 and earlier versions
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "webaccess",
"scope": "eq",
"trust": 1.6,
"vendor": "advantech",
"version": "7.0"
},
{
"_id": null,
"model": "webaccess",
"scope": "eq",
"trust": 1.6,
"vendor": "advantech",
"version": "5.0"
},
{
"_id": null,
"model": "webaccess",
"scope": "eq",
"trust": 1.6,
"vendor": "advantech",
"version": "6.0"
},
{
"_id": null,
"model": "webaccess",
"scope": "lt",
"trust": 1.4,
"vendor": "advantech",
"version": "7.2"
},
{
"_id": null,
"model": "webaccess",
"scope": "lte",
"trust": 1.0,
"vendor": "advantech",
"version": "7.1"
},
{
"_id": null,
"model": "webaccess",
"scope": null,
"trust": 0.7,
"vendor": "advantech",
"version": null
},
{
"_id": null,
"model": "webaccess",
"scope": "eq",
"trust": 0.6,
"vendor": "advantech",
"version": "7.1"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "advantech webaccess",
"version": "5.0"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "advantech webaccess",
"version": "6.0"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "advantech webaccess",
"version": "7.0"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "advantech webaccess",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "7d71e152-463f-11e9-af14-000c29342cb1"
},
{
"db": "IVD",
"id": "e482e66e-2351-11e6-abef-000c29c66e3d"
},
{
"db": "ZDI",
"id": "ZDI-14-251"
},
{
"db": "CNVD",
"id": "CNVD-2014-04462"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003488"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-477"
},
{
"db": "NVD",
"id": "CVE-2014-2365"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:advantech:advantech_webaccess",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003488"
}
]
},
"credits": {
"_id": null,
"data": "John Leitch",
"sources": [
{
"db": "ZDI",
"id": "ZDI-14-251"
}
],
"trust": 0.7
},
"cve": "CVE-2014-2365",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.0,
"id": "CVE-2014-2365",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "ZDI",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CVE-2014-2365",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.0,
"id": "CNVD-2014-04462",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.0,
"id": "7d71e152-463f-11e9-af14-000c29342cb1",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.0,
"id": "e482e66e-2351-11e6-abef-000c29c66e3d",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.0,
"id": "VHN-70304",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:N/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-2365",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-2365",
"trust": 0.8,
"value": "Medium"
},
{
"author": "ZDI",
"id": "CVE-2014-2365",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2014-04462",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201407-477",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7d71e152-463f-11e9-af14-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "e482e66e-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-70304",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d71e152-463f-11e9-af14-000c29342cb1"
},
{
"db": "IVD",
"id": "e482e66e-2351-11e6-abef-000c29c66e3d"
},
{
"db": "ZDI",
"id": "ZDI-14-251"
},
{
"db": "CNVD",
"id": "CNVD-2014-04462"
},
{
"db": "VULHUB",
"id": "VHN-70304"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003488"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-477"
},
{
"db": "NVD",
"id": "CVE-2014-2365"
}
]
},
"description": {
"_id": null,
"data": "Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gmicons.asp functionality. An attacker may leverage this to run arbitrary code in the context of the WebAccess service. WebAccess HMI/SCADA software provides remote control and management, allowing users to easily view and configure automation equipment in facility management systems, power stations and building automation systems. Advantech WebAccess is prone to a remote code-execution vulnerability. Failed exploit attempts will likely cause a denial-of-service condition. \nAdvantech WebAccess 7.1 and prior are vulnerable. Advantech WebAccess is a browser-based HMI/SCADA software developed by Advantech. There are security vulnerabilities in Advantech WebAccess 7.1 and earlier versions",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2365"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003488"
},
{
"db": "ZDI",
"id": "ZDI-14-251"
},
{
"db": "CNVD",
"id": "CNVD-2014-04462"
},
{
"db": "BID",
"id": "68718"
},
{
"db": "IVD",
"id": "7d71e152-463f-11e9-af14-000c29342cb1"
},
{
"db": "IVD",
"id": "e482e66e-2351-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-70304"
}
],
"trust": 3.51
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2014-2365",
"trust": 4.5
},
{
"db": "ICS CERT",
"id": "ICSA-14-198-02",
"trust": 2.5
},
{
"db": "CNNVD",
"id": "CNNVD-201407-477",
"trust": 1.1
},
{
"db": "CNVD",
"id": "CNVD-2014-04462",
"trust": 1.0
},
{
"db": "BID",
"id": "68718",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003488",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-2086",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-14-251",
"trust": 0.7
},
{
"db": "IVD",
"id": "7D71E152-463F-11E9-AF14-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "E482E66E-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-70304",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "7d71e152-463f-11e9-af14-000c29342cb1"
},
{
"db": "IVD",
"id": "e482e66e-2351-11e6-abef-000c29c66e3d"
},
{
"db": "ZDI",
"id": "ZDI-14-251"
},
{
"db": "CNVD",
"id": "CNVD-2014-04462"
},
{
"db": "VULHUB",
"id": "VHN-70304"
},
{
"db": "BID",
"id": "68718"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003488"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-477"
},
{
"db": "NVD",
"id": "CVE-2014-2365"
}
]
},
"id": "VAR-201407-0234",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d71e152-463f-11e9-af14-000c29342cb1"
},
{
"db": "IVD",
"id": "e482e66e-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04462"
},
{
"db": "VULHUB",
"id": "VHN-70304"
}
],
"trust": 1.53470696
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "7d71e152-463f-11e9-af14-000c29342cb1"
},
{
"db": "IVD",
"id": "e482e66e-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04462"
}
]
},
"last_update_date": "2024-11-23T22:02:04.971000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Downloads ::: WebAccess Software",
"trust": 0.8,
"url": "http://webaccess.advantech.com/downloads.php?item=software"
},
{
"title": "Advantech WebAccess",
"trust": 0.8,
"url": "http://webaccess.advantech.com/"
},
{
"title": "Advantech has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-198-02"
},
{
"title": "Patch for Advantech WebAccess Remote Code Execution Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/47712"
},
{
"title": "AdvantechWebAccessCHNNode_20140606_3.4.3",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=50905"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-14-251"
},
{
"db": "CNVD",
"id": "CNVD-2014-04462"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003488"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-477"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2365"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 3.2,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-198-02"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2365"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2365"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/68718"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-14-251"
},
{
"db": "CNVD",
"id": "CNVD-2014-04462"
},
{
"db": "VULHUB",
"id": "VHN-70304"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003488"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-477"
},
{
"db": "NVD",
"id": "CVE-2014-2365"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "IVD",
"id": "7d71e152-463f-11e9-af14-000c29342cb1",
"ident": null
},
{
"db": "IVD",
"id": "e482e66e-2351-11e6-abef-000c29c66e3d",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-14-251",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2014-04462",
"ident": null
},
{
"db": "VULHUB",
"id": "VHN-70304",
"ident": null
},
{
"db": "BID",
"id": "68718",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003488",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201407-477",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2014-2365",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2014-07-22T00:00:00",
"db": "IVD",
"id": "7d71e152-463f-11e9-af14-000c29342cb1",
"ident": null
},
{
"date": "2014-07-22T00:00:00",
"db": "IVD",
"id": "e482e66e-2351-11e6-abef-000c29c66e3d",
"ident": null
},
{
"date": "2014-07-18T00:00:00",
"db": "ZDI",
"id": "ZDI-14-251",
"ident": null
},
{
"date": "2014-07-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04462",
"ident": null
},
{
"date": "2014-07-19T00:00:00",
"db": "VULHUB",
"id": "VHN-70304",
"ident": null
},
{
"date": "2014-07-18T00:00:00",
"db": "BID",
"id": "68718",
"ident": null
},
{
"date": "2014-07-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003488",
"ident": null
},
{
"date": "2014-07-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-477",
"ident": null
},
{
"date": "2014-07-19T05:09:27.627000",
"db": "NVD",
"id": "CVE-2014-2365",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2014-07-18T00:00:00",
"db": "ZDI",
"id": "ZDI-14-251",
"ident": null
},
{
"date": "2014-07-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04462",
"ident": null
},
{
"date": "2014-07-23T00:00:00",
"db": "VULHUB",
"id": "VHN-70304",
"ident": null
},
{
"date": "2014-07-22T00:07:00",
"db": "BID",
"id": "68718",
"ident": null
},
{
"date": "2014-07-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003488",
"ident": null
},
{
"date": "2014-07-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-477",
"ident": null
},
{
"date": "2024-11-21T02:06:09.417000",
"db": "NVD",
"id": "CVE-2014-2365",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-477"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "Advantech WebAccess Remote code execution vulnerability",
"sources": [
{
"db": "IVD",
"id": "7d71e152-463f-11e9-af14-000c29342cb1"
},
{
"db": "IVD",
"id": "e482e66e-2351-11e6-abef-000c29c66e3d"
},
{
"db": "ZDI",
"id": "ZDI-14-251"
},
{
"db": "CNVD",
"id": "CNVD-2014-04462"
}
],
"trust": 1.7
},
"type": {
"_id": null,
"data": "Code injection",
"sources": [
{
"db": "IVD",
"id": "7d71e152-463f-11e9-af14-000c29342cb1"
},
{
"db": "IVD",
"id": "e482e66e-2351-11e6-abef-000c29c66e3d"
}
],
"trust": 0.4
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.