CVE-2018-7495: Advantech WebAccess, обхождане на път

Описание

Оригинално описание

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an external control of file name or path vulnerability has been identified, which may allow an attacker to delete files.

Засегнати продукти

• Advantech WebAccess: WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, WebAccess/NMS 2.0.3 and prior.

Вид слабост

• CWE-73 Външен контрол върху име или път на файл

История

Други уязвимости в Advantech WebAccess

• 6.5CVE-2023-4215
• 9.8CVE-2021-38389
• 9.8CVE-2021-33023
• CVE-2019-3941
• CVE-2019-3940

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2018-7495
• https://nvd.nist.gov/vuln/detail/CVE-2018-7495
• http://www.securityfocus.com/bid/104190
• https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01