CVE-2014-0771CWE-538

Advantech WebAccess File and Directory Information Exposure

High · published April 12, 2014

CVSS v2.0
7.5
EPSS
1%
Percentile
72.3
In the wild
Unconfirmed
What it is

The BWOCXRUN.BwocxrunCtrl.1 control contains a method named

“OpenUrlToBuffer.” This method takes a URL as a parameter and returns

its contents to the caller in JavaScript. The URLs are accessed in the

security context of the current browser session. The control does not

perform any URL validation and allows “file://” URLs that access the

local disk.

The method can be used to open a URL (including file URLs) and read

file URLs through JavaScript. This method could also be used to reach

any arbitrary URL to which the browser has access.

The record
Technical detail
CVSS v2.0
7.5 · HIGH
Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v4.0
Not supplied
EPSS
0.01409 · 72.3th percentile
Weakness
CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory
Published
2014-04-12T01:00Z
EPSS history
Timeline
  • 12 APR 01:00Z
    Advantech WebAccess File and Directory Information Exposure
    cvelistv5