Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2014-0771

Severity CVSS v4.0:
Pending analysis
Type:
CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
Publication date:
12/04/2014
Last modified:
19/09/2025

Description

The BWOCXRUN.BwocxrunCtrl.1 control contains a method named <br /> “OpenUrlToBuffer.” This method takes a URL as a parameter and returns <br /> its contents to the caller in JavaScript. The URLs are accessed in the <br /> security context of the current browser session. The control does not <br /> perform any URL validation and allows “file://” URLs that access the <br /> local disk.<br /> <br /> <br /> The method can be used to open a URL (including file URLs) and read <br /> file URLs through JavaScript. This method could also be used to reach <br /> any arbitrary URL to which the browser has access.

Impact

Vector 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:P CVSS v2.0 Severity and Metrics:

Base Score: 7.50 HIGH
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Attack Vector (AV): Network
Attack Complexity (AC): Low
Authentication (Au): None
Confidentiality (C): Physical
Integrity (I): Physical
Availability (A): Physical

Base Score 2.0
7.50
Severity 2.0
HIGH

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:advantech:advantech_webaccess:*:*:*:*:*:*:*:* 7.1 (including)
cpe:2.3:a:advantech:advantech_webaccess:5.0:*:*:*:*:*:*:*
cpe:2.3:a:advantech:advantech_webaccess:6.0:*:*:*:*:*:*:*
cpe:2.3:a:advantech:advantech_webaccess:7.0:*:*:*:*:*:*:*

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools