Sign-up

ID

VAR-201810-0131


CVE

CVE-2018-15707


TITLE

Advantech WebAccess Bwmainleft.asp Page Cross-Site Scripting Vulnerability

Trust: 0.8

sources: IVD: e300ebb1-39ab-11e9-a0a4-000c29342cb1 // CNVD: CNVD-2018-22714

DESCRIPTION

Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things. Advantech WebAccess is a suite of browser-based HMI/SCADA software from Advantech. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment

Trust: 2.52

sources: NVD: CVE-2018-15707 // JVNDB: JVNDB-2018-011789 // CNVD: CNVD-2018-22714 // IVD: e300ebb1-39ab-11e9-a0a4-000c29342cb1 // VULHUB: VHN-125993 // VULMON: CVE-2018-15707

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: e300ebb1-39ab-11e9-a0a4-000c29342cb1 // CNVD: CNVD-2018-22714

AFFECTED PRODUCTS

vendor:advantechmodel:webaccessscope:eqversion:8.3.1

Trust: 3.0

vendor:advantechmodel:webaccessscope:eqversion:8.3.2

Trust: 3.0

vendor:webaccessmodel: - scope:eqversion:8.3.1

Trust: 0.2

vendor:webaccessmodel: - scope:eqversion:8.3.2

Trust: 0.2

sources: IVD: e300ebb1-39ab-11e9-a0a4-000c29342cb1 // CNVD: CNVD-2018-22714 // JVNDB: JVNDB-2018-011789 // CNNVD: CNNVD-201810-1564 // NVD: CVE-2018-15707

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-15707
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-15707
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2018-22714
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201810-1564
value: LOW

Trust: 0.6

IVD: e300ebb1-39ab-11e9-a0a4-000c29342cb1
value: LOW

Trust: 0.2

VULHUB: VHN-125993
value: LOW

Trust: 0.1

VULMON: CVE-2018-15707
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2018-15707
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2018-22714
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e300ebb1-39ab-11e9-a0a4-000c29342cb1
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-125993
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-15707
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.0

Trust: 1.8

sources: IVD: e300ebb1-39ab-11e9-a0a4-000c29342cb1 // CNVD: CNVD-2018-22714 // VULHUB: VHN-125993 // VULMON: CVE-2018-15707 // JVNDB: JVNDB-2018-011789 // CNNVD: CNNVD-201810-1564 // NVD: CVE-2018-15707

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-125993 // JVNDB: JVNDB-2018-011789 // NVD: CVE-2018-15707

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201810-1564

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201810-1564

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-011789

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-125993 // 
            
            
            
            VULMON: CVE-2018-15707

PATCH
title:Advantech WebAccessurl:http://www.advantech.com/industrial-automation/webaccess/webaccessscada
Trust: 0.8
title:Advantech WebAccess Bwmainleft.asp page cross-site scripting vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/143979
Trust: 0.6
title:Exp101tsArchiv30thersurl:https://github.com/nu11secur1ty/Exp101tsArchiv30thers 
Trust: 0.1
title: - url:https://github.com/lnick2023/nicenice 
Trust: 0.1
title:awesome-cve-poc_qazbnm456url:https://github.com/xbl3/awesome-cve-poc_qazbnm456 
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-22714 // 
            
            
            
            VULMON: CVE-2018-15707 // 
            
            
            
            JVNDB: JVNDB-2018-011789

EXTERNAL IDS
db:NVDid:CVE-2018-15707
Trust: 3.4
db:TENABLEid:TRA-2018-35
Trust: 3.2
db:EXPLOIT-DBid:45774
Trust: 1.2
db:CNNVDid:CNNVD-201810-1564
Trust: 0.9
db:CNVDid:CNVD-2018-22714
Trust: 0.8
db:JVNDBid:JVNDB-2018-011789
Trust: 0.8
db:IVDid:E300EBB1-39AB-11E9-A0A4-000C29342CB1
Trust: 0.2
db:VULHUBid:VHN-125993
Trust: 0.1
db:VULMONid:CVE-2018-15707
Trust: 0.1
sources:
            
            
            IVD: e300ebb1-39ab-11e9-a0a4-000c29342cb1 // 
            
            
            
            CNVD: CNVD-2018-22714 // 
            
            
            
            VULHUB: VHN-125993 // 
            
            
            
            VULMON: CVE-2018-15707 // 
            
            
            
            JVNDB: JVNDB-2018-011789 // 
            
            
            
            CNNVD: CNNVD-201810-1564 // 
            
            
            
            NVD: CVE-2018-15707

REFERENCES
url:https://www.tenable.com/security/research/tra-2018-35
Trust: 3.2
url:https://www.exploit-db.com/exploits/45774/
Trust: 1.3
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15707
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-15707
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/79.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-22714 // 
            
            
            
            VULHUB: VHN-125993 // 
            
            
            
            VULMON: CVE-2018-15707 // 
            
            
            
            JVNDB: JVNDB-2018-011789 // 
            
            
            
            CNNVD: CNNVD-201810-1564 // 
            
            
            
            NVD: CVE-2018-15707

SOURCES
db:IVDid:e300ebb1-39ab-11e9-a0a4-000c29342cb1
db:CNVDid:CNVD-2018-22714
db:VULHUBid:VHN-125993
db:VULMONid:CVE-2018-15707
db:JVNDBid:JVNDB-2018-011789
db:CNNVDid:CNNVD-201810-1564
db:NVDid:CVE-2018-15707

LAST UPDATE DATE
2024-08-14T13:45:33.399000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-22714date:2018-11-08T00:00:00
db:VULHUBid:VHN-125993date:2018-12-12T00:00:00
db:VULMONid:CVE-2018-15707date:2018-12-12T00:00:00
db:JVNDBid:JVNDB-2018-011789date:2019-01-23T00:00:00
db:CNNVDid:CNNVD-201810-1564date:2018-11-01T00:00:00
db:NVDid:CVE-2018-15707date:2018-12-12T17:19:31.953

SOURCES RELEASE DATE
db:IVDid:e300ebb1-39ab-11e9-a0a4-000c29342cb1date:2018-11-08T00:00:00
db:CNVDid:CNVD-2018-22714date:2018-11-07T00:00:00
db:VULHUBid:VHN-125993date:2018-10-31T00:00:00
db:VULMONid:CVE-2018-15707date:2018-10-31T00:00:00
db:JVNDBid:JVNDB-2018-011789date:2019-01-23T00:00:00
db:CNNVDid:CNNVD-201810-1564date:2018-11-01T00:00:00
db:NVDid:CVE-2018-15707date:2018-10-31T22:29:00.523