CVE-2019-6519
published 2019-02-05CVE-2019-6519: WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload…
PriorityP265critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
2.81%
84.7th percentile
WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload malicious data.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advantech | webaccess_scada | — | — |
| chrome_chrome | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2019-6519 affects Advantech WebAccess/SCADA Version 8.3 specifically; detection should target this version for improper authentication allowing unauthenticated malicious data upload ↗
- →The vulnerability is remotely exploitable with no authentication required (CVSS PR:N, UI:N), meaning unauthenticated upload requests to WebAccess/SCADA 8.3 endpoints should be flagged ↗
- →No known public exploits were identified at time of advisory; monitor for anomalous unauthenticated file upload activity targeting WebAccess/SCADA ↗
- ·Only WebAccess/SCADA Version 8.3 is confirmed affected; Version 8.3.5 is the patched release ↗
- ·CVSS v3 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating full network-accessible exploitation with no privileges or user interaction required ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m2g2-fwmq-4v79: WebAccess/SCADA, Version 8
ghsa_unreviewed·2022-05-14
CVE-2019-6519 [CRITICAL] CWE-287 GHSA-m2g2-fwmq-4v79: WebAccess/SCADA, Version 8
WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload malicious data.
Chrome
Stable Channel Update for Desktop: CVE-2020-6518
vendor_chrome·2020-07-14·CVSS 8.8
CVE-2020-6518 [MEDIUM] Stable Channel Update for Desktop: CVE-2020-6518
Stable Channel Update for Desktop
CVE-2020-6518: Use after free in developer tools. Reported by David Erceg on 2019-07-20
[$3000][ 1064676 ] Medium CVE-2020-6519: Policy bypass in CSP
Reported by Wenxu Wu (@ma7h1as) of Tencent Security Xuanwu Lab on 2019-04-23, and also by Gal Weizman (@WeizmanGal) of PerimeterX on 2020-03-25
Severity: medium
CISA ICS
Advantech WebAccess/SCADA
cisa_ics·2019-01-24·CVSS 9.8
[CRITICAL] Advantech WebAccess/SCADA
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Advantech WebAccess/SCADA
Last RevisedJanuary 24, 2019
Alert CodeICSA-19-024-01
## 1. EXECUTIVE SUMMARY
-
CVSS v3 9.8
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: Advantech
- Equipment: WebAccess/SCADA
- Vulnerabilities: Improper Authentication, Authentication Bypass, SQL Injection
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow an attacker to access and manipulate sensitive data.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of WebAccess/SCADA, a SCADA software platform, are affected:
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-02-05
Published