CVE-2014-0772 Advantech WebAccess File and Directory Information Exposure
MediumCVSS 5.0
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named
OpenUrlToBufferTimeout. This method takes a URL as a parameter and
returns its contents to the caller in JavaScript. The URLs are accessed
in the security context of the current browser session. The control does
not perform any URL validation and allows file:// URLs that access the
local disk.
The method can be used to open a URL (including file URLs) and read
the URLs through JavaScript. This method could also be used to reach any
arbitrary URL to which the browser has access.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| advantech webaccess | <= 7.1 | No fix listed |
| advantech webaccess | = 5.0 | No fix listed |
| advantech webaccess | = 6.0 | No fix listed |
| advantech webaccess | = 7.0 | No fix listed |
References
- webaccess.advantech.com
- 66740 vdb-entry
- www.cisa.gov
- ics-cert.us-cert.gov us-government-resource