CVE-2020-14501: Advantech iView UserServlet performDeleteUser Missing Authentication for Critical Function Information Disclosure Vulnerability
First published: Wed Jul 15 2020(Updated: )
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also delete the administrator account.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Advantech iView | <=5.6 | |
| Advantech iView | ||
| Advantech iView Versions 5.6 and prior |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-14501?
CVE-2020-14501 is a vulnerability in Advantech iView that allows remote attackers to disclose sensitive information without authentication.
How severe is CVE-2020-14501?
CVE-2020-14501 has a severity rating of 9.8, which is considered critical.
How can CVE-2020-14501 be exploited?
CVE-2020-14501 can be exploited by remote attackers without authentication to disclose sensitive information.
What is the affected software for CVE-2020-14501?
The affected software for CVE-2020-14501 is Advantech iView version up to 5.6.
Are there any references available for CVE-2020-14501?
Yes, you can find references for CVE-2020-14501 at the following URLs: 1. https://us-cert.cisa.gov/ics/advisories/icsa-20-196-01 2. https://www.zerodayinitiative.com/advisories/ZDI-20-859/ 3. https://us-cert.cisa.gov/ics/advisories/icsa-20-196-33
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/title
- agent/severity
- agent/first-publish-date
- agent/description
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-20-859
- alias/ZDI-CAN-10699
- alias/CVE-2020-14501
- agent/software-canonical-lookup
- agent/event
- agent/softwarecombine
- agent/references
- agent/tags
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup-request
- vendor/advantech
- canonical/advantech iview
- version/advantech iview/5.6
- canonical/advantech iview versions 5.6 and prior