CVE-2017-12710
published 2017-08-30CVE-2017-12710: A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to…
PriorityP347high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
2.21%
80.4th percentile
A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advantech | webaccess | <= 8.2 | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Advantech WebAccess
cisa_ics·2017-08-29
Advantech WebAccess
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Advantech WebAccess
Last RevisedAugust 29, 2017
Alert CodeICSA-17-241-02
## CVSS v3 7.8
ATTENTION: Remotely exploitable/low skill level to exploit.
Vendor: Advantech
Equipment: WebAccess
Vulnerabilities: SQL Injection, Out-of-Bounds Access, Multiple Buffer Overflows, Externally Controlled Format String, Improper Authentication, Incorrect Permission Assignment for Critical Resource, Incorrect Privilege Assignment, Uncontrolled Search Path Element.
## AFFECTED PRODUCTS
The following versions of WebAccess, an HMI platform, are affected:
- WebAccess versions prior to V8.2_2017
GHSA
GHSA-8fcv-7gfh-gg6g: A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8
ghsa_unreviewed·2022-05-17
CVE-2017-12710 [HIGH] CWE-89 GHSA-8fcv-7gfh-gg6g: A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8
A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/100526http://www.zerodayinitiative.com/advisories/ZDI-17-712/https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02https://www.tenable.com/security/research/tra-2017-29http://www.securityfocus.com/bid/100526http://www.zerodayinitiative.com/advisories/ZDI-17-712/https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02https://www.tenable.com/security/research/tra-2017-29
2017-08-30
Published