Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-0771

The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “OpenUrlToBuffer.” This method takes a URL as a parameter and returns its contents to the caller in JavaScript. The URLs are accessed in the security context of the current browser session. The control does not perform any URL validation and allows “file://” URLs that access the local disk. The method can be used to open a URL (including file URLs) and read file URLs through JavaScript. This method could also be used to reach any arbitrary URL to which the browser has access.

Published

2014-04-12T04:37:31.643

Last Modified

2025-09-19T20:15:37.683

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-538
  • Type: Secondary
    CWE-200
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application advantech advantech_webaccess ≤ 7.1 Yes
Application advantech advantech_webaccess 5.0 Yes
Application advantech advantech_webaccess 6.0 Yes
Application advantech advantech_webaccess 7.0 Yes
References