CVE-2014-2366: Advantech WebAccess Cleartext Storage of Sensitive Information in Memory
Published Jul 19, 2014
·Updated
upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.
Affected Software
4 affected components
Advantech Advantech WebAccess<=7.1
Advantech Advantech WebAccess=5.0
Advantech Advantech WebAccess=6.0
Advantech Advantech WebAccess=7.0
Remediation
Information
Advantech released a new WebAccess Installation Package v7.2 on June
6, 2014, that removes some vulnerable ActiveX components and resolves
the vulnerabilities within others. The download link for v7.2 is
available at:
http://webaccess.advantech.com/
Event History
Jul 19, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·05:09 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2366?
CVE-2014-2366 is rated as medium severity due to its potential to allow credential discovery.
2
How do I fix CVE-2014-2366?
To fix CVE-2014-2366, upgrade Advantech WebAccess to version 7.2 or later.
3
Who is affected by CVE-2014-2366?
Users of Advantech WebAccess versions prior to 7.2, including versions 5.0, 6.0, and 7.0, are affected by CVE-2014-2366.
4
What are the implications of CVE-2014-2366?
CVE-2014-2366 allows remote authenticated users to discover sensitive credentials through the HTML source code.
5
Is there a workaround for CVE-2014-2366?
Currently, the recommended action for CVE-2014-2366 is to upgrade to a secure version, as there are no acknowledged workarounds.