Authentication bypass in Advantech WebAccess - CVE-2017-5152

Vulnerability details

The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to incorrectly imposed permissions to specific URL. A remote attacker can use a specially crafted URL to gain unauthorized access to Advantech WebAccess.

Successful exploitation will grant an attacker unauthorized access to web application.

Affected software

How to mitigate CVE-2017-5152

External References

• https://ics-cert.us-cert.gov/advisories/ICSA-17-012-01
• http://www.zerodayinitiative.com/advisories/ZDI-17-043/

Related Security Bulletins

• SQL injection and authentication bypass in Advantech WebAccess