CVE-2017-12713
published 2017-08-30CVE-2017-12713: An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and…
PriorityP335high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.35%
26.9th percentile
An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advantech | webaccess | <= 8.2 | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Advantech WebAccess
cisa_ics·2017-08-29
Advantech WebAccess
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Advantech WebAccess
Last RevisedAugust 29, 2017
Alert CodeICSA-17-241-02
## CVSS v3 7.8
ATTENTION: Remotely exploitable/low skill level to exploit.
Vendor: Advantech
Equipment: WebAccess
Vulnerabilities: SQL Injection, Out-of-Bounds Access, Multiple Buffer Overflows, Externally Controlled Format String, Improper Authentication, Incorrect Permission Assignment for Critical Resource, Incorrect Privilege Assignment, Uncontrolled Search Path Element.
## AFFECTED PRODUCTS
The following versions of WebAccess, an HMI platform, are affected:
- WebAccess versions prior to V8.2_2017
GHSA
GHSA-hhjc-g6qw-64jj: An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8
ghsa_unreviewed·2022-05-13
CVE-2017-12713 [HIGH] CWE-732 GHSA-hhjc-g6qw-64jj: An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8
An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-08-30
Published