CVE-2014-2368: Advantech WebAccess Unsafe ActiveX Control Marked Safe For Scripting
Published Jul 19, 2014
·Updated
The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
Affected Software
4 affected components
Advantech Advantech WebAccess<=7.1
Advantech Advantech WebAccess=5.0
Advantech Advantech WebAccess=6.0
Advantech Advantech WebAccess=7.0
Remediation
Information
Advantech released a new WebAccess Installation Package v7.2 on June
6, 2014, that removes some vulnerable ActiveX components and resolves
the vulnerabilities within others. The download link for v7.2 is
available at:
http://webaccess.advantech.com/
Event History
Jul 19, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·05:09 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2368?
CVE-2014-2368 is classified as a medium severity vulnerability due to its potential to allow unauthorized file access.
2
How do I fix CVE-2014-2368?
To mitigate CVE-2014-2368, upgrade Advantech WebAccess to version 7.2 or later.
3
What type of attacks can exploit CVE-2014-2368?
CVE-2014-2368 can be exploited by remote attackers to read arbitrary files from the system.
4
Which versions of Advantech WebAccess are affected by CVE-2014-2368?
CVE-2014-2368 affects Advantech WebAccess versions up to and including 7.1, as well as versions 5.0, 6.0, and 7.0.
5
What is the BrowseFolder method in CVE-2014-2368?
The BrowseFolder method in CVE-2014-2368 is an ActiveX control function that can be manipulated to read files from a remote attacker's perspective.