CVE-2017-12710

Опубликовано: 30 авг. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information.

Ссылки

http://www.securityfocus.com/bid/100526
Third Party Advisory
VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-17-712/
https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02
Third Party Advisory
US Government Resource
https://www.tenable.com/security/research/tra-2017-29
http://www.securityfocus.com/bid/100526
Third Party Advisory
VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-17-712/
https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02
Third Party Advisory
US Government Resource
https://www.tenable.com/security/research/tra-2017-29

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:advantech:webaccess:*:*:*:*:*:*:*:*

Версия до 8.2 (включая)

EPSS

Процентиль: 65%

0.00495

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-8fcv-7gfh-gg6g