CVE-2021-22654: Advantech iView UserServlet SQL Injection Information Disclosure Vulnerability
Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetworkServlet class. When parsing the ztpconfigname parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UserServlet class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-22654 vulnerability?
CVE-2021-22654 is an SQL Injection Information Disclosure vulnerability in Advantech iView, which allows remote attackers to disclose sensitive information without authentication.
How does CVE-2021-22654 vulnerability impact affected installations?
The vulnerability allows remote attackers to exploit Advantech iView installations and disclose sensitive information.
Is authentication required to exploit CVE-2021-22654 vulnerability?
No, authentication is not required to exploit this vulnerability.
What is the severity of CVE-2021-22654 vulnerability?
The severity of CVE-2021-22654 vulnerability is high, with a severity value of 7.5.
How can I fix the CVE-2021-22654 vulnerability?
To fix the vulnerability, affected installations should apply the latest security patches or updates provided by Advantech.