CVE-2021-22656: Advantech iView CommandServlet Directory Traversal Information Disclosure Vulnerability
Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CommandServlet class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this Advantech iView vulnerability?
The vulnerability ID of this Advantech iView vulnerability is CVE-2021-22656.
What is the title of this vulnerability?
The title of this vulnerability is Advantech iView CommandServlet Directory Traversal Information Disclosure Vulnerability.
What is the severity of CVE-2021-22656?
The severity of CVE-2021-22656 is high with a CVSS score of 7.5.
Which software is affected by CVE-2021-22656?
The software affected by CVE-2021-22656 is Advantech iView up to version 5.7.03.6112.
How can this vulnerability be exploited?
This vulnerability can be exploited by remote attackers to disclose sensitive information without authentication.