Sign-up

ID

VAR-201202-0343


CVE

CVE-2012-1235


TITLE

Advantech/BroadWin WebAccess Cross-Site Request Forgery Vulnerability

Trust: 1.8

sources: IVD: 1a0e738c-2354-11e6-abef-000c29c66e3d // IVD: 7d789810-463f-11e9-88a7-000c29342cb1 // IVD: 4ad6fb9a-1f73-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-9017 // CNNVD: CNNVD-201202-422

DESCRIPTION

Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235. Advantech/BroadWin WebAccess Contains a cross-site request forgery vulnerability. BroadWin SCADA WebAccess is a web browser-based HMI and SCADA software for industrial control systems and automation

Trust: 2.79

sources: NVD: CVE-2012-1235 // JVNDB: JVNDB-2012-001564 // CNVD: CNVD-2012-9017 // IVD: 1a0e738c-2354-11e6-abef-000c29c66e3d // IVD: 7d789810-463f-11e9-88a7-000c29342cb1 // IVD: 4ad6fb9a-1f73-11e6-abef-000c29c66e3d // VULHUB: VHN-54516

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.2

sources: IVD: 1a0e738c-2354-11e6-abef-000c29c66e3d // IVD: 7d789810-463f-11e9-88a7-000c29342cb1 // IVD: 4ad6fb9a-1f73-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-9017

AFFECTED PRODUCTS

vendor:advantechmodel:webaccessscope:eqversion:5.0

Trust: 1.6

vendor:advantechmodel:webaccessscope:lteversion:6.0

Trust: 1.0

vendor:broadwinmodel:webaccessscope:eqversion:7.0

Trust: 0.8

vendor:advantechmodel:webaccessscope:eqversion:7.0

Trust: 0.8

vendor:advantech webaccessmodel: - scope:eqversion:5.0

Trust: 0.6

vendor:advantech webaccessmodel: - scope:eqversion:*

Trust: 0.6

vendor:webaccessmodel:advantech/broadwinscope:eqversion:7.0

Trust: 0.6

vendor:advantechmodel:webaccessscope:eqversion:6.0

Trust: 0.6

sources: IVD: 1a0e738c-2354-11e6-abef-000c29c66e3d // IVD: 7d789810-463f-11e9-88a7-000c29342cb1 // IVD: 4ad6fb9a-1f73-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-9017 // JVNDB: JVNDB-2012-001564 // CNNVD: CNNVD-201202-422 // NVD: CVE-2012-1235

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-1235
value: MEDIUM

Trust: 1.0

NVD: CVE-2012-1235
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2012-9017
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201202-422
value: MEDIUM

Trust: 0.6

IVD: 1a0e738c-2354-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

IVD: 7d789810-463f-11e9-88a7-000c29342cb1
value: MEDIUM

Trust: 0.2

IVD: 4ad6fb9a-1f73-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

VULHUB: VHN-54516
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2012-1235
severity: MEDIUM
baseScore: 6.0
vectorString: AV:N/AC:M/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.8
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2012-9017
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 1a0e738c-2354-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 7d789810-463f-11e9-88a7-000c29342cb1
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 4ad6fb9a-1f73-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-54516
severity: MEDIUM
baseScore: 6.0
vectorString: AV:N/AC:M/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.8
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: 1a0e738c-2354-11e6-abef-000c29c66e3d // IVD: 7d789810-463f-11e9-88a7-000c29342cb1 // IVD: 4ad6fb9a-1f73-11e6-abef-000c29c66e3d // CNVD: CNVD-2012-9017 // VULHUB: VHN-54516 // JVNDB: JVNDB-2012-001564 // CNNVD: CNNVD-201202-422 // NVD: CVE-2012-1235

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-54516 // JVNDB: JVNDB-2012-001564 // NVD: CVE-2012-1235

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201202-422

TYPE

Cross Site Request Forgery

Trust: 0.6

sources: IVD: 1a0e738c-2354-11e6-abef-000c29c66e3d // IVD: 7d789810-463f-11e9-88a7-000c29342cb1 // IVD: 4ad6fb9a-1f73-11e6-abef-000c29c66e3d

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-001564

PATCH
title:WebAccessurl:http://www.advantech.co.jp/products/Webaccess-HMI-SCADA-Software/sub_GF-1M94V.aspx
Trust: 0.8
title:WebAccessurl:http://www.broadwin.com/features.htm
Trust: 0.8
title:Offices Distributorsurl:http://www.broadwin.com/Offices.htm
Trust: 0.8
title:パートナー情報url:http://www.advantech.co.jp/support-AJP/distributors.asp
Trust: 0.8
title:Top Pageurl:http://www.advantech.co.jp/
Trust: 0.8
title:Advantech/BroadWin WebAccess cross-site request forgery vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/34072
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2012-9017 // 
            
            
            
            JVNDB: JVNDB-2012-001564

EXTERNAL IDS
db:NVDid:CVE-2012-1235
Trust: 3.7
db:ICS CERTid:ICSA-12-047-01
Trust: 1.7
db:CNNVDid:CNNVD-201202-422
Trust: 1.3
db:CNVDid:CNVD-2012-9017
Trust: 1.2
db:ICS CERTid:ICSA-12-047-01A
Trust: 0.8
db:JVNDBid:JVNDB-2012-001564
Trust: 0.8
db:IVDid:1A0E738C-2354-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:IVDid:7D789810-463F-11E9-88A7-000C29342CB1
Trust: 0.2
db:IVDid:4AD6FB9A-1F73-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:VULHUBid:VHN-54516
Trust: 0.1
sources:
            
            
            IVD: 1a0e738c-2354-11e6-abef-000c29c66e3d // 
            
            
            
            IVD: 7d789810-463f-11e9-88a7-000c29342cb1 // 
            
            
            
            IVD: 4ad6fb9a-1f73-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2012-9017 // 
            
            
            
            VULHUB: VHN-54516 // 
            
            
            
            JVNDB: JVNDB-2012-001564 // 
            
            
            
            CNNVD: CNNVD-201202-422 // 
            
            
            
            NVD: CVE-2012-1235

REFERENCES
url:http://www.us-cert.gov/control_systems/pdf/icsa-12-047-01.pdf
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1235
Trust: 0.8
url:http://www.us-cert.gov/control_systems/pdf/icsa-12-047-01a.pdf
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1235
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/search-results?query=cve-2012-1235
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2012-9017 // 
            
            
            
            VULHUB: VHN-54516 // 
            
            
            
            JVNDB: JVNDB-2012-001564 // 
            
            
            
            CNNVD: CNNVD-201202-422 // 
            
            
            
            NVD: CVE-2012-1235

SOURCES
db:IVDid:1a0e738c-2354-11e6-abef-000c29c66e3d
db:IVDid:7d789810-463f-11e9-88a7-000c29342cb1
db:IVDid:4ad6fb9a-1f73-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2012-9017
db:VULHUBid:VHN-54516
db:JVNDBid:JVNDB-2012-001564
db:CNNVDid:CNNVD-201202-422
db:NVDid:CVE-2012-1235

LAST UPDATE DATE
2024-08-14T13:36:43.804000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2012-9017date:2012-02-22T00:00:00
db:VULHUBid:VHN-54516date:2012-02-23T00:00:00
db:JVNDBid:JVNDB-2012-001564date:2012-02-23T00:00:00
db:CNNVDid:CNNVD-201202-422date:2012-02-22T00:00:00
db:NVDid:CVE-2012-1235date:2012-02-23T05:00:00

SOURCES RELEASE DATE
db:IVDid:1a0e738c-2354-11e6-abef-000c29c66e3ddate:2012-02-22T00:00:00
db:IVDid:7d789810-463f-11e9-88a7-000c29342cb1date:2012-02-22T00:00:00
db:IVDid:4ad6fb9a-1f73-11e6-abef-000c29c66e3ddate:2012-02-22T00:00:00
db:CNVDid:CNVD-2012-9017date:2012-02-22T00:00:00
db:VULHUBid:VHN-54516date:2012-02-21T00:00:00
db:JVNDBid:JVNDB-2012-001564date:2012-02-23T00:00:00
db:CNNVDid:CNNVD-201202-422date:2012-02-22T00:00:00
db:NVDid:CVE-2012-1235date:2012-02-21T13:31:57.330