CVE-2021-38431: Advantech WebAccess SCADA

Q: How severe is CVE-2021-38431?

The severity of CVE-2021-38431 is considered medium with a CVSS score of 4.3.

Q: How can I mitigate CVE-2021-38431?

To mitigate CVE-2021-38431, users should update Advantech WebAccess SCADA to version 9.0.4 or later.

Q: What is the CWE associated with CVE-2021-38431?

The CWE associated with CVE-2021-38431 is CWE-862.

Published Oct 15, 2021

Updated

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users.

Affected Software

2 affected components

Advantech WebAccess/SCADA<=9.0.3

Advantech WebAccess SCADA<=9.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Advantech WebAccess SCADA to a version that resolves this vulnerability.
Fixed in 9.1.1
Upgrade
Upgrade Advantech WebAccess SCADA to a version that resolves this vulnerability.
Fixed in 9.0.3

Event History

Oct 15, 2021

CVE Published

via MITRE·12:29 PM

Data Sourced

via MITRE·12:29 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-21-285-01

Frequently Asked Questions

What is CVE-2021-38431 vulnerability?

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can utilize API functions to reveal project names and paths from other users.

How severe is CVE-2021-38431?

The severity of CVE-2021-38431 is considered medium with a CVSS score of 4.3.

How can I mitigate CVE-2021-38431?