Sign-up

ID

VAR-201705-3745


CVE

CVE-2017-7929


TITLE

Advantech WebAccess Path traversal vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2017-003931 // CNNVD: CNNVD-201704-931

DESCRIPTION

An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, which may allow an attacker to traverse the file system to access restricted files or directories. Advantech WebAccess Contains a path traversal vulnerability.Information is obtained and service operation is interrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of Advantech WebAccess. Authentication is required to exploit this vulnerability.The specific flaw exists within odbcPg4.asp. An attacker can leverage this vulnerability to overwrite key web files which will disable functionality on the target machine. Advantech WebAccess is a suite of browser-based HMI/SCADA software from Advantech. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. A directory traversal vulnerability exists in Advantech WebAccess due to the application's failure to adequately filter user-supplied input. A remote attacker exploited the vulnerability to retrieve sensitive information and execute arbitrary code through a specially crafted request with a directory traversal sequence ('../'). This may aid in further attacks. Advantech WebAccess version 8.1 and prior are vulnerable

Trust: 3.33

sources: NVD: CVE-2017-7929 // JVNDB: JVNDB-2017-003931 // ZDI: ZDI-17-322 // CNVD: CNVD-2017-06980 // BID: 98311 // IVD: 72b8f504-9faf-4e5e-9287-87f7cb248c3e // VULHUB: VHN-116132

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 72b8f504-9faf-4e5e-9287-87f7cb248c3e // CNVD: CNVD-2017-06980

AFFECTED PRODUCTS

vendor:advantechmodel:webaccessscope:lteversion:8.1

Trust: 1.8

vendor:advantechmodel:webaccessscope:eqversion:8.1

Trust: 0.9

vendor:advantechmodel:webaccessscope: - version: -

Trust: 0.7

vendor:advantechmodel:webaccessscope:lteversion:<=8.1

Trust: 0.6

vendor:advantechmodel:webaccess 8.0 20150816scope: - version: -

Trust: 0.3

vendor:advantechmodel:webaccessscope:eqversion:8

Trust: 0.3

vendor:advantechmodel:webaccessscope:eqversion:7.2

Trust: 0.3

vendor:advantechmodel:webaccess 8.2 20170330scope:neversion: -

Trust: 0.3

vendor:webaccessmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 72b8f504-9faf-4e5e-9287-87f7cb248c3e // ZDI: ZDI-17-322 // CNVD: CNVD-2017-06980 // BID: 98311 // JVNDB: JVNDB-2017-003931 // CNNVD: CNNVD-201704-931 // NVD: CVE-2017-7929

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-7929
value: HIGH

Trust: 1.0

NVD: CVE-2017-7929
value: HIGH

Trust: 0.8

ZDI: CVE-2017-7929
value: MEDIUM

Trust: 0.7

CNVD: CNVD-2017-06980
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201704-931
value: HIGH

Trust: 0.6

IVD: 72b8f504-9faf-4e5e-9287-87f7cb248c3e
value: HIGH

Trust: 0.2

VULHUB: VHN-116132
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-7929
severity: MEDIUM
baseScore: 5.5
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ZDI: CVE-2017-7929
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

CNVD: CNVD-2017-06980
severity: MEDIUM
baseScore: 5.5
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 72b8f504-9faf-4e5e-9287-87f7cb248c3e
severity: MEDIUM
baseScore: 5.5
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-116132
severity: MEDIUM
baseScore: 5.5
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-7929
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 4.2
version: 3.0

Trust: 1.8

sources: IVD: 72b8f504-9faf-4e5e-9287-87f7cb248c3e // ZDI: ZDI-17-322 // CNVD: CNVD-2017-06980 // VULHUB: VHN-116132 // JVNDB: JVNDB-2017-003931 // CNNVD: CNNVD-201704-931 // NVD: CVE-2017-7929

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.9

problemtype:CWE-36

Trust: 1.0

sources: VULHUB: VHN-116132 // JVNDB: JVNDB-2017-003931 // NVD: CVE-2017-7929

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201704-931

TYPE

Path traversal

Trust: 0.8

sources: IVD: 72b8f504-9faf-4e5e-9287-87f7cb248c3e // CNNVD: CNNVD-201704-931

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-003931

PATCH
title:Advantech WebAccessurl:http://www.advantech.com/industrial-automation/webaccess
Trust: 0.8
title:Advantech has issued an update to correct this vulnerability.url:https://ics-cert.us-cert.gov/advisories/ICSA-17-124-03
Trust: 0.7
title:Patch for Advantech WebAccess Directory Traversal Vulnerability (CNVD-2017-06980)url:https://www.cnvd.org.cn/patchInfo/show/93984
Trust: 0.6
title:Advantech WebAccess Repair measures for path traversal vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99746
Trust: 0.6
sources:
            
            
            ZDI: ZDI-17-322 // 
            
            
            
            CNVD: CNVD-2017-06980 // 
            
            
            
            JVNDB: JVNDB-2017-003931 // 
            
            
            
            CNNVD: CNNVD-201704-931

EXTERNAL IDS
db:NVDid:CVE-2017-7929
Trust: 4.3
db:ICS CERTid:ICSA-17-124-03
Trust: 2.8
db:BIDid:98311
Trust: 2.6
db:CNNVDid:CNNVD-201704-931
Trust: 0.9
db:CNVDid:CNVD-2017-06980
Trust: 0.8
db:JVNDBid:JVNDB-2017-003931
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-4013
Trust: 0.7
db:ZDIid:ZDI-17-322
Trust: 0.7
db:IVDid:72B8F504-9FAF-4E5E-9287-87F7CB248C3E
Trust: 0.2
db:VULHUBid:VHN-116132
Trust: 0.1
sources:
            
            
            IVD: 72b8f504-9faf-4e5e-9287-87f7cb248c3e // 
            
            
            
            ZDI: ZDI-17-322 // 
            
            
            
            CNVD: CNVD-2017-06980 // 
            
            
            
            VULHUB: VHN-116132 // 
            
            
            
            BID: 98311 // 
            
            
            
            JVNDB: JVNDB-2017-003931 // 
            
            
            
            CNNVD: CNNVD-201704-931 // 
            
            
            
            NVD: CVE-2017-7929

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-17-124-03
Trust: 3.5
url:http://www.securityfocus.com/bid/98311
Trust: 2.3
url:https://nvd.nist.gov/vuln/detail/cve-2017-7929
Trust: 1.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7929
Trust: 0.8
url:http://www.advantech.in/
Trust: 0.3
sources:
            
            
            ZDI: ZDI-17-322 // 
            
            
            
            CNVD: CNVD-2017-06980 // 
            
            
            
            VULHUB: VHN-116132 // 
            
            
            
            BID: 98311 // 
            
            
            
            JVNDB: JVNDB-2017-003931 // 
            
            
            
            CNNVD: CNNVD-201704-931 // 
            
            
            
            NVD: CVE-2017-7929

CREDITS
Zhou Yu
Trust: 0.7
sources:
            
            
            ZDI: ZDI-17-322

SOURCES
db:IVDid:72b8f504-9faf-4e5e-9287-87f7cb248c3e
db:ZDIid:ZDI-17-322
db:CNVDid:CNVD-2017-06980
db:VULHUBid:VHN-116132
db:BIDid:98311
db:JVNDBid:JVNDB-2017-003931
db:CNNVDid:CNNVD-201704-931
db:NVDid:CVE-2017-7929

LAST UPDATE DATE
2024-08-14T13:56:47.985000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-17-322date:2017-05-04T00:00:00
db:CNVDid:CNVD-2017-06980date:2017-05-19T00:00:00
db:VULHUBid:VHN-116132date:2019-10-09T00:00:00
db:BIDid:98311date:2017-05-23T16:23:00
db:JVNDBid:JVNDB-2017-003931date:2017-06-12T00:00:00
db:CNNVDid:CNNVD-201704-931date:2019-10-17T00:00:00
db:NVDid:CVE-2017-7929date:2019-10-09T23:29:59.843

SOURCES RELEASE DATE
db:IVDid:72b8f504-9faf-4e5e-9287-87f7cb248c3edate:2017-05-19T00:00:00
db:ZDIid:ZDI-17-322date:2017-05-04T00:00:00
db:CNVDid:CNVD-2017-06980date:2017-05-19T00:00:00
db:VULHUBid:VHN-116132date:2017-05-06T00:00:00
db:BIDid:98311date:2017-05-04T00:00:00
db:JVNDBid:JVNDB-2017-003931date:2017-06-12T00:00:00
db:CNNVDid:CNNVD-201704-931date:2017-04-20T00:00:00
db:NVDid:CVE-2017-7929date:2017-05-06T00:29:00.490