Sign-up

ID

VAR-202004-0077


CVE

CVE-2020-10617


TITLE

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

Trust: 9.1

sources: ZDI: ZDI-20-438 // ZDI: ZDI-20-439 // ZDI: ZDI-20-395 // ZDI: ZDI-20-416 // ZDI: ZDI-20-396 // ZDI: ZDI-20-442 // ZDI: ZDI-20-434 // ZDI: ZDI-20-408 // ZDI: ZDI-20-437 // ZDI: ZDI-20-418 // ZDI: ZDI-20-407 // ZDI: ZDI-20-422 // ZDI: ZDI-20-441

DESCRIPTION

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of calls to the getSeverByAlarm method of the DBUtil class. When parsing the events parameter of the emsEvents endpoint, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose files in the context of SYSTEM

Trust: 12.33

sources: NVD: CVE-2020-10617 // ZDI: ZDI-20-374 // ZDI: ZDI-20-380 // ZDI: ZDI-20-441 // ZDI: ZDI-20-422 // ZDI: ZDI-20-407 // ZDI: ZDI-20-418 // ZDI: ZDI-20-437 // ZDI: ZDI-20-408 // ZDI: ZDI-20-438 // ZDI: ZDI-20-434 // ZDI: ZDI-20-445 // ZDI: ZDI-20-442 // ZDI: ZDI-20-396 // ZDI: ZDI-20-416 // ZDI: ZDI-20-395 // ZDI: ZDI-20-439 // ZDI: ZDI-20-412 // ZDI: ZDI-20-378 // VULMON: CVE-2020-10617

AFFECTED PRODUCTS

vendor:advantechmodel:webaccess/nmsscope: - version: -

Trust: 12.6

vendor:advantechmodel:webaccess\/nmsscope:ltversion:3.0.2

Trust: 1.0

sources: ZDI: ZDI-20-438 // ZDI: ZDI-20-374 // ZDI: ZDI-20-412 // ZDI: ZDI-20-439 // ZDI: ZDI-20-395 // ZDI: ZDI-20-416 // ZDI: ZDI-20-396 // ZDI: ZDI-20-442 // ZDI: ZDI-20-445 // ZDI: ZDI-20-434 // ZDI: ZDI-20-378 // ZDI: ZDI-20-408 // ZDI: ZDI-20-437 // ZDI: ZDI-20-418 // ZDI: ZDI-20-407 // ZDI: ZDI-20-422 // ZDI: ZDI-20-441 // ZDI: ZDI-20-380 // NVD: CVE-2020-10617

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: CVE-2020-10617
value: HIGH

Trust: 12.6

nvd@nist.gov: CVE-2020-10617
value: HIGH

Trust: 1.0

VULMON: CVE-2020-10617
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-10617
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

ZDI: CVE-2020-10617
baseSeverity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 12.6

nvd@nist.gov: CVE-2020-10617
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: ZDI: ZDI-20-438 // ZDI: ZDI-20-374 // ZDI: ZDI-20-412 // ZDI: ZDI-20-439 // ZDI: ZDI-20-395 // ZDI: ZDI-20-416 // ZDI: ZDI-20-396 // ZDI: ZDI-20-442 // ZDI: ZDI-20-445 // ZDI: ZDI-20-434 // ZDI: ZDI-20-378 // ZDI: ZDI-20-408 // ZDI: ZDI-20-437 // ZDI: ZDI-20-418 // ZDI: ZDI-20-407 // ZDI: ZDI-20-422 // ZDI: ZDI-20-441 // ZDI: ZDI-20-380 // VULMON: CVE-2020-10617 // NVD: CVE-2020-10617

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.0

sources: NVD: CVE-2020-10617

PATCH

title:Advantech has issued an update to correct this vulnerability.url:https://www.us-cert.gov/ics/advisories/icsa-20-098-01

Trust: 12.6

sources: ZDI: ZDI-20-438 // ZDI: ZDI-20-374 // ZDI: ZDI-20-412 // ZDI: ZDI-20-439 // ZDI: ZDI-20-395 // ZDI: ZDI-20-416 // ZDI: ZDI-20-396 // ZDI: ZDI-20-442 // ZDI: ZDI-20-445 // ZDI: ZDI-20-434 // ZDI: ZDI-20-378 // ZDI: ZDI-20-408 // ZDI: ZDI-20-437 // ZDI: ZDI-20-418 // ZDI: ZDI-20-407 // ZDI: ZDI-20-422 // ZDI: ZDI-20-441 // ZDI: ZDI-20-380

EXTERNAL IDS

db:NVDid:CVE-2020-10617

Trust: 13.7

db:ICS CERTid:ICSA-20-098-01

Trust: 1.1

db:ZDI_CANid:ZDI-CAN-9820

Trust: 0.7

db:ZDIid:ZDI-20-438

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9567

Trust: 0.7

db:ZDIid:ZDI-20-374

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9765

Trust: 0.7

db:ZDIid:ZDI-20-412

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9821

Trust: 0.7

db:ZDIid:ZDI-20-439

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9589

Trust: 0.7

db:ZDIid:ZDI-20-395

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9776

Trust: 0.7

db:ZDIid:ZDI-20-416

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9601

Trust: 0.7

db:ZDIid:ZDI-20-396

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9824

Trust: 0.7

db:ZDIid:ZDI-20-442

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9827

Trust: 0.7

db:ZDIid:ZDI-20-445

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9816

Trust: 0.7

db:ZDIid:ZDI-20-434

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9571

Trust: 0.7

db:ZDIid:ZDI-20-378

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9700

Trust: 0.7

db:ZDIid:ZDI-20-408

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9819

Trust: 0.7

db:ZDIid:ZDI-20-437

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9778

Trust: 0.7

db:ZDIid:ZDI-20-418

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9699

Trust: 0.7

db:ZDIid:ZDI-20-407

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9801

Trust: 0.7

db:ZDIid:ZDI-20-422

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9823

Trust: 0.7

db:ZDIid:ZDI-20-441

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9573

Trust: 0.7

db:ZDIid:ZDI-20-380

Trust: 0.7

db:VULMONid:CVE-2020-10617

Trust: 0.1

sources: ZDI: ZDI-20-438 // ZDI: ZDI-20-374 // ZDI: ZDI-20-412 // ZDI: ZDI-20-439 // ZDI: ZDI-20-395 // ZDI: ZDI-20-416 // ZDI: ZDI-20-396 // ZDI: ZDI-20-442 // ZDI: ZDI-20-445 // ZDI: ZDI-20-434 // ZDI: ZDI-20-378 // ZDI: ZDI-20-408 // ZDI: ZDI-20-437 // ZDI: ZDI-20-418 // ZDI: ZDI-20-407 // ZDI: ZDI-20-422 // ZDI: ZDI-20-441 // ZDI: ZDI-20-380 // VULMON: CVE-2020-10617 // NVD: CVE-2020-10617

REFERENCES

url:https://www.us-cert.gov/ics/advisories/icsa-20-098-01

Trust: 13.7

url:https://cwe.mitre.org/data/definitions/89.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-20-438 // ZDI: ZDI-20-374 // ZDI: ZDI-20-412 // ZDI: ZDI-20-439 // ZDI: ZDI-20-395 // ZDI: ZDI-20-416 // ZDI: ZDI-20-396 // ZDI: ZDI-20-442 // ZDI: ZDI-20-445 // ZDI: ZDI-20-434 // ZDI: ZDI-20-378 // ZDI: ZDI-20-408 // ZDI: ZDI-20-437 // ZDI: ZDI-20-418 // ZDI: ZDI-20-407 // ZDI: ZDI-20-422 // ZDI: ZDI-20-441 // ZDI: ZDI-20-380 // VULMON: CVE-2020-10617 // NVD: CVE-2020-10617

CREDITS

rgod of 9sg

Trust: 12.6

sources: ZDI: ZDI-20-438 // ZDI: ZDI-20-374 // ZDI: ZDI-20-412 // ZDI: ZDI-20-439 // ZDI: ZDI-20-395 // ZDI: ZDI-20-416 // ZDI: ZDI-20-396 // ZDI: ZDI-20-442 // ZDI: ZDI-20-445 // ZDI: ZDI-20-434 // ZDI: ZDI-20-378 // ZDI: ZDI-20-408 // ZDI: ZDI-20-437 // ZDI: ZDI-20-418 // ZDI: ZDI-20-407 // ZDI: ZDI-20-422 // ZDI: ZDI-20-441 // ZDI: ZDI-20-380

SOURCES

db:ZDIid:ZDI-20-438
db:ZDIid:ZDI-20-374
db:ZDIid:ZDI-20-412
db:ZDIid:ZDI-20-439
db:ZDIid:ZDI-20-395
db:ZDIid:ZDI-20-416
db:ZDIid:ZDI-20-396
db:ZDIid:ZDI-20-442
db:ZDIid:ZDI-20-445
db:ZDIid:ZDI-20-434
db:ZDIid:ZDI-20-378
db:ZDIid:ZDI-20-408
db:ZDIid:ZDI-20-437
db:ZDIid:ZDI-20-418
db:ZDIid:ZDI-20-407
db:ZDIid:ZDI-20-422
db:ZDIid:ZDI-20-441
db:ZDIid:ZDI-20-380
db:VULMONid:CVE-2020-10617
db:NVDid:CVE-2020-10617

LAST UPDATE DATE

2024-10-16T23:04:01.434000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-20-438date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-374date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-412date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-439date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-395date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-416date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-396date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-442date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-445date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-434date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-378date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-408date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-437date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-418date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-407date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-422date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-441date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-380date:2020-04-08T00:00:00
db:VULMONid:CVE-2020-10617date:2020-04-09T00:00:00
db:NVDid:CVE-2020-10617date:2020-04-09T19:52:32.123

SOURCES RELEASE DATE

db:ZDIid:ZDI-20-438date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-374date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-412date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-439date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-395date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-416date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-396date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-442date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-445date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-434date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-378date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-408date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-437date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-418date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-407date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-422date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-441date:2020-04-08T00:00:00
db:ZDIid:ZDI-20-380date:2020-04-08T00:00:00
db:VULMONid:CVE-2020-10617date:2020-04-09T00:00:00
db:NVDid:CVE-2020-10617date:2020-04-09T14:15:12.510