Details of VAR-202004-0077

ID

VAR-202004-0077

CVE

CVE-2020-10617

TITLE

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

Trust: 9.1

sources: ZDI: ZDI-20-438 // ZDI: ZDI-20-439 // ZDI: ZDI-20-395 // ZDI: ZDI-20-416 // ZDI: ZDI-20-396 // ZDI: ZDI-20-427 // ZDI: ZDI-20-440 // ZDI: ZDI-20-429 // ZDI: ZDI-20-399 // ZDI: ZDI-20-419 // ZDI: ZDI-20-437 // ZDI: ZDI-20-430 // ZDI: ZDI-20-417

DESCRIPTION

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of calls to the getSeverByAlarm method of the DBUtil class. When parsing the events parameter of the emsEvents endpoint, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose files in the context of SYSTEM

Trust: 12.87

sources: NVD: CVE-2020-10617 // ZDI: ZDI-20-374 // ZDI: ZDI-20-380 // ZDI: ZDI-20-390 // ZDI: ZDI-20-417 // ZDI: ZDI-20-410 // ZDI: ZDI-20-430 // ZDI: ZDI-20-437 // ZDI: ZDI-20-419 // ZDI: ZDI-20-399 // ZDI: ZDI-20-438 // ZDI: ZDI-20-440 // ZDI: ZDI-20-427 // ZDI: ZDI-20-409 // ZDI: ZDI-20-396 // ZDI: ZDI-20-416 // ZDI: ZDI-20-395 // ZDI: ZDI-20-439 // ZDI: ZDI-20-412 // ZDI: ZDI-20-429

AFFECTED PRODUCTS

vendor:	advantech	model:	webaccess/nms	scope:	-	version:	-	Trust: 13.3
vendor:	advantech	model:	webaccess\/nms	scope:	lt	version:	3.0.2	Trust: 1.0

sources: ZDI: ZDI-20-438 // ZDI: ZDI-20-374 // ZDI: ZDI-20-412 // ZDI: ZDI-20-439 // ZDI: ZDI-20-395 // ZDI: ZDI-20-416 // ZDI: ZDI-20-396 // ZDI: ZDI-20-409 // ZDI: ZDI-20-427 // ZDI: ZDI-20-440 // ZDI: ZDI-20-429 // ZDI: ZDI-20-399 // ZDI: ZDI-20-419 // ZDI: ZDI-20-437 // ZDI: ZDI-20-430 // ZDI: ZDI-20-410 // ZDI: ZDI-20-417 // ZDI: ZDI-20-390 // ZDI: ZDI-20-380 // NVD: CVE-2020-10617

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI:	CVE-2020-10617
value:	HIGH
Trust: 13.3
nvd@nist.gov:	CVE-2020-10617
value:	HIGH
Trust: 1.0

nvd@nist.gov:	CVE-2020-10617
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0

ZDI:	CVE-2020-10617
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 13.3
nvd@nist.gov:	CVE-2020-10617
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0

PROBLEMTYPE DATA

problemtype:

CWE-89

Trust: 1.0

sources: NVD: CVE-2020-10617

PATCH

title:

Advantech has issued an update to correct this vulnerability.

url:

https://www.us-cert.gov/ics/advisories/icsa-20-098-01

Trust: 13.3

EXTERNAL IDS

db:	NVD	id:	CVE-2020-10617	Trust: 14.3
db:	ICS CERT	id:	ICSA-20-098-01	Trust: 1.0
db:	ZDI_CAN	id:	ZDI-CAN-9820	Trust: 0.7
db:	ZDI	id:	ZDI-20-438	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9567	Trust: 0.7
db:	ZDI	id:	ZDI-20-374	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9765	Trust: 0.7
db:	ZDI	id:	ZDI-20-412	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9821	Trust: 0.7
db:	ZDI	id:	ZDI-20-439	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9589	Trust: 0.7
db:	ZDI	id:	ZDI-20-395	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9776	Trust: 0.7
db:	ZDI	id:	ZDI-20-416	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9601	Trust: 0.7
db:	ZDI	id:	ZDI-20-396	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9701	Trust: 0.7
db:	ZDI	id:	ZDI-20-409	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9806	Trust: 0.7
db:	ZDI	id:	ZDI-20-427	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9822	Trust: 0.7
db:	ZDI	id:	ZDI-20-440	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9810	Trust: 0.7
db:	ZDI	id:	ZDI-20-429	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9613	Trust: 0.7
db:	ZDI	id:	ZDI-20-399	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9793	Trust: 0.7
db:	ZDI	id:	ZDI-20-419	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9819	Trust: 0.7
db:	ZDI	id:	ZDI-20-437	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9812	Trust: 0.7
db:	ZDI	id:	ZDI-20-430	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9759	Trust: 0.7
db:	ZDI	id:	ZDI-20-410	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9777	Trust: 0.7
db:	ZDI	id:	ZDI-20-417	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9583	Trust: 0.7
db:	ZDI	id:	ZDI-20-390	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9573	Trust: 0.7
db:	ZDI	id:	ZDI-20-380	Trust: 0.7

REFERENCES

url:

https://www.us-cert.gov/ics/advisories/icsa-20-098-01

Trust: 14.3

CREDITS

rgod of 9sg

Trust: 12.6

SOURCES

db:	ZDI	id:	ZDI-20-438
db:	ZDI	id:	ZDI-20-374
db:	ZDI	id:	ZDI-20-412
db:	ZDI	id:	ZDI-20-439
db:	ZDI	id:	ZDI-20-395
db:	ZDI	id:	ZDI-20-416
db:	ZDI	id:	ZDI-20-396
db:	ZDI	id:	ZDI-20-409
db:	ZDI	id:	ZDI-20-427
db:	ZDI	id:	ZDI-20-440
db:	ZDI	id:	ZDI-20-429
db:	ZDI	id:	ZDI-20-399
db:	ZDI	id:	ZDI-20-419
db:	ZDI	id:	ZDI-20-437
db:	ZDI	id:	ZDI-20-430
db:	ZDI	id:	ZDI-20-410
db:	ZDI	id:	ZDI-20-417
db:	ZDI	id:	ZDI-20-390
db:	ZDI	id:	ZDI-20-380
db:	NVD	id:	CVE-2020-10617

LAST UPDATE DATE

2025-02-20T22:31:59.486000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-20-438	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-374	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-412	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-439	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-395	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-416	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-396	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-409	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-427	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-440	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-429	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-399	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-419	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-437	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-430	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-410	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-417	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-390	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-380	date:	2020-04-08T00:00:00
db:	NVD	id:	CVE-2020-10617	date:	2024-11-21T04:55:42.477

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-20-438	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-374	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-412	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-439	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-395	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-416	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-396	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-409	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-427	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-440	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-429	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-399	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-419	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-437	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-430	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-410	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-417	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-390	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-380	date:	2020-04-08T00:00:00
db:	NVD	id:	CVE-2020-10617	date:	2020-04-09T14:15:12.510