Vulnerabilites related to automatedlogic - webctrl
var-201708-1398
Vulnerability from variot
A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to overwrite files that are used to execute code. This vulnerability does not affect version 6.5 of the software. ALC WebCTRL , i-Vu ,and SiteScan Web Contains a path traversal vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ALC WebCTRL is a building automation platform. Multiple Automated Logic Corporation Products are prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability. An attacker can exploit these issues to obtain sensitive information, to upload arbitrary code, and run it in the context of the webserver process. WebCTRL®, Automated Logic's web-based building automationsystem, is known for its intuitive user interface and powerful integrationcapabilities. It allows building operators to optimize and manageall of their building systems - including HVAC, lighting, fire, elevators,and security - all within a single HVAC controls platform. It's everythingthey need to keep occupants comfortable, manage energy conservation measures,identify key operational problems, and validate the results.WebCTRL suffers from an authenticated arbitrary code execution vulnerability. The issue is caused due to the improper verification when uploading Add-on (.addons or .war) files using the uploadwarfile servlet. This can be exploited to execute arbitrary code by uploading a malicious web archive file that will run automatically and can be accessed from within the webroot directory. Additionaly, an improper authorization access control occurs when using the 'anonymous' user. By specification, the anonymous user should not have permissions or authorization to upload or install add-ons. The anonymous user was removed from version 6.5 of WebCTRL.Tested on: Microsoft Windows 7 Professional (6.1.7601 Service Pack 1 Build 7601)Apache-Coyote/1.1Apache Tomcat/7.0.42CJServer/1.1Java/1.7.0_25-b17Java HotSpot Server VM 23.25-b01Ant 1.7.0Axis 1.4Trove 2.0.2Xalan Java 2.4.1Xerces-J 2.6.1. The vulnerability exist due to the improper permissions,with the 'M' flag (Modify) or 'C' flag (Change) for 'Authenticated Users' group.The application suffers from an unquoted search path issue as well impacting the service'WebCTRL Service' for Windows deployed as part of WebCTRL server solution. This couldpotentially allow an authorized but non-privileged local user to execute arbitrarycode with elevated privileges on the system. A successful attempt would require thelocal user to be able to insert their code in the system root path undetected by theOS or other security applications where it could potentially be executed duringapplication startup or reboot. If successful, the local user’s code would executewith the elevated privileges of the application.Tested on: Microsoft Windows 7 Professional SP1 (EN).
Desc: The vulnerability is triggered by an authenticated user that can use the manualcommand console in the management panel of the affected application. The ManualCommand() function in ManualCommand.js allows users to perform additional diagnostics and settings overview by using pre-defined set of commands. This can be exploited by using the echo command to write and/or overwrite arbitrary files on the system including directory traversal throughout the system
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201708-1398", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.5", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.1", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "5.2", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "6.0", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "5.5", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.2", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "6.1", }, { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.2", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.5", }, { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.0", }, { model: null, scope: "eq", trust: 0.8, vendor: "webctrl", version: "*", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.2", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.5", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.0", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.2", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.5", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.1", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.2", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.5", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.0", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.1", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: null, scope: "eq", trust: 0.6, vendor: "i vu", version: "*", }, { model: null, scope: "eq", trust: 0.6, vendor: "sitescan web", version: "*", }, { model: "sitescan web", scope: "lte", trust: 0.6, vendor: "ibm automated logic", version: "<=6.5", }, { model: "alc webctrl i-vu", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.0", }, { model: "alc webctrl sitescan web", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.1", }, { model: "sitescan web i-vu alc webctrl", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.5", }, { model: "sitescan web i-vu alc webctrl", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=5.5", }, { model: "sitescan web i-vu alc webctrl", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=5.2", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.0", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.5", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.2", }, { model: "webctrl", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.1", }, { model: "webctrl", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.5", }, { model: "webctrl", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.2", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.1", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.2", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.5", }, { model: "webctrl", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.0", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " sitescan web 6.1 and prior", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " i-vu 6.0 and prior", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " sitescan web 5.5 and prior", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " sitescan web 5.2 and prior", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1 and 6.0", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.0", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.0", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: "webctrl", scope: "lte", trust: 0.2, vendor: "automated logic", version: " sitescan web 6.5 and prior", }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", }, { db: "CNVD", id: "CNVD-2017-22829", }, { db: "BID", id: "100452", }, { db: "JVNDB", id: "JVNDB-2017-007643", }, { db: "CNNVD", id: "CNNVD-201706-863", }, { db: "NVD", id: "CVE-2017-9640", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { cpe_match: [ { cpe22Uri: "cpe:/a:automatedlogic:i-vu", vulnerable: true, }, { cpe22Uri: "cpe:/a:automatedlogic:sitescan_web", vulnerable: true, }, { cpe22Uri: "cpe:/a:automatedlogic:webctrl", vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "JVNDB", id: "JVNDB-2017-007643", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Vulnerability discovered by Gjoko Krstic", sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, ], trust: 0.3, }, cve: "CVE-2017-9640", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", author: "nvd@nist.gov", availabilityImpact: "PARTIAL", baseScore: 6.5, confidentialityImpact: "PARTIAL", exploitabilityScore: 8, id: "CVE-2017-9640", impactScore: 6.4, integrityImpact: "PARTIAL", severity: "MEDIUM", trust: 1.8, vectorString: "AV:N/AC:L/Au:S/C:P/I:P/A:P", version: "2.0", }, { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "CNVD", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", exploitabilityScore: 10, id: "CNVD-2017-22829", impactScore: 6.4, integrityImpact: "PARTIAL", severity: "HIGH", trust: 0.6, vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "IVD", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", exploitabilityScore: 10, id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", impactScore: 6.4, integrityImpact: "PARTIAL", severity: "HIGH", trust: 0.2, vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.9 [IVD]", }, ], cvssV3: [ { attackComplexity: "LOW", attackVector: "NETWORK", author: "nvd@nist.gov", availabilityImpact: "LOW", baseScore: 6.3, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", exploitabilityScore: 2.8, id: "CVE-2017-9640", impactScore: 3.4, integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", trust: 1.8, userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", version: "3.0", }, ], severity: [ { author: "nvd@nist.gov", id: "CVE-2017-9640", trust: 1, value: "MEDIUM", }, { author: "NVD", id: "CVE-2017-9640", trust: 0.8, value: "Medium", }, { author: "CNVD", id: "CNVD-2017-22829", trust: 0.6, value: "HIGH", }, { author: "CNNVD", id: "CNNVD-201706-863", trust: 0.6, value: "MEDIUM", }, { author: "IVD", id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", trust: 0.2, value: "MEDIUM", }, { author: "ZSL", id: "ZSL-2017-5431", trust: 0.1, value: "(4/5)", }, { author: "ZSL", id: "ZSL-2017-5430", trust: 0.1, value: "(3/5)", }, { author: "ZSL", id: "ZSL-2017-5429", trust: 0.1, value: "(3/5)", }, ], }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", }, { db: "CNVD", id: "CNVD-2017-22829", }, { db: "JVNDB", id: "JVNDB-2017-007643", }, { db: "CNNVD", id: "CNNVD-201706-863", }, { db: "NVD", id: "CVE-2017-9640", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to overwrite files that are used to execute code. This vulnerability does not affect version 6.5 of the software. ALC WebCTRL , i-Vu ,and SiteScan Web Contains a path traversal vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ALC WebCTRL is a building automation platform. Multiple Automated Logic Corporation Products are prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability. \nAn attacker can exploit these issues to obtain sensitive information, to upload arbitrary code, and run it in the context of the webserver process. WebCTRL®, Automated Logic's web-based building automationsystem, is known for its intuitive user interface and powerful integrationcapabilities. It allows building operators to optimize and manageall of their building systems - including HVAC, lighting, fire, elevators,and security - all within a single HVAC controls platform. It's everythingthey need to keep occupants comfortable, manage energy conservation measures,identify key operational problems, and validate the results.WebCTRL suffers from an authenticated arbitrary code execution vulnerability. The issue is caused due to the improper verification when uploading Add-on (.addons or .war) files using the uploadwarfile servlet. This can be exploited to execute arbitrary code by uploading a malicious web archive file that will run automatically and can be accessed from within the webroot directory. Additionaly, an improper authorization access control occurs when using the 'anonymous' user. By specification, the anonymous user should not have permissions or authorization to upload or install add-ons. The anonymous user was removed from version 6.5 of WebCTRL.Tested on: Microsoft Windows 7 Professional (6.1.7601 Service Pack 1 Build 7601)Apache-Coyote/1.1Apache Tomcat/7.0.42CJServer/1.1Java/1.7.0_25-b17Java HotSpot Server VM 23.25-b01Ant 1.7.0Axis 1.4Trove 2.0.2Xalan Java 2.4.1Xerces-J 2.6.1. The vulnerability exist due to the improper permissions,with the 'M' flag (Modify) or 'C' flag (Change) for 'Authenticated Users' group.The application suffers from an unquoted search path issue as well impacting the service'WebCTRL Service' for Windows deployed as part of WebCTRL server solution. This couldpotentially allow an authorized but non-privileged local user to execute arbitrarycode with elevated privileges on the system. A successful attempt would require thelocal user to be able to insert their code in the system root path undetected by theOS or other security applications where it could potentially be executed duringapplication startup or reboot. If successful, the local user’s code would executewith the elevated privileges of the application.Tested on: Microsoft Windows 7 Professional SP1 (EN). \n\nDesc: The vulnerability is triggered by an authenticated user that can use\nthe manualcommand console in the management panel of the affected application. \nThe ManualCommand() function in ManualCommand.js allows users to perform additional\ndiagnostics and settings overview by using pre-defined set of commands. This\ncan be exploited by using the echo command to write and/or overwrite arbitrary\nfiles on the system including directory traversal throughout the system", sources: [ { db: "NVD", id: "CVE-2017-9640", }, { db: "JVNDB", id: "JVNDB-2017-007643", }, { db: "CNVD", id: "CNVD-2017-22829", }, { db: "BID", id: "100452", }, { db: "IVD", id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", }, { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "PACKETSTORM", id: "143896", }, ], trust: 2.97, }, exploit_availability: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { reference: "http://www.automatedlogic.com/pages/security.aspx", trust: 0.3, type: "poc", }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, ], }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2017-9640", trust: 3.7, }, { db: "ICS CERT", id: "ICSA-17-234-01", trust: 3, }, { db: "BID", id: "100452", trust: 2.1, }, { db: "EXPLOIT-DB", id: "42543", trust: 1.7, }, { db: "CNVD", id: "CNVD-2017-22829", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-201706-863", trust: 0.8, }, { db: "JVNDB", id: "JVNDB-2017-007643", trust: 0.8, }, { db: "PACKETSTORM", id: "143896", trust: 0.2, }, { db: "ZSL", id: "ZSL-2017-5430", trust: 0.2, }, { db: "IVD", id: "F06FBADD-BAE1-46A3-8A6F-C5A536B9697E", trust: 0.2, }, { db: "PACKETSTORM", id: "143897", trust: 0.1, }, { db: "EXPLOIT-DB", id: "42544", trust: 0.1, }, { db: "NVD", id: "CVE-2017-9650", trust: 0.1, }, { db: "CXSECURITY", id: "WLB-2017080166", trust: 0.1, }, { db: "ZSL", id: "ZSL-2017-5431", trust: 0.1, }, { db: "AUSCERT", id: "ESB-2017.2113", trust: 0.1, }, { db: "CXSECURITY", id: "WLB-2017080165", trust: 0.1, }, { db: "CXSECURITY", id: "WLB-2017080167", trust: 0.1, }, { db: "NVD", id: "CVE-2017-9644", trust: 0.1, }, { db: "BID", id: "100454", trust: 0.1, }, { db: "EXPLOIT-DB", id: "42542", trust: 0.1, }, { db: "PACKETSTORM", id: "143895", trust: 0.1, }, { db: "ZSL", id: "ZSL-2017-5429", trust: 0.1, }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", }, { db: "CNVD", id: "CNVD-2017-22829", }, { db: "BID", id: "100452", }, { db: "JVNDB", id: "JVNDB-2017-007643", }, { db: "PACKETSTORM", id: "143896", }, { db: "CNNVD", id: "CNNVD-201706-863", }, { db: "NVD", id: "CVE-2017-9640", }, ], }, id: "VAR-201708-1398", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "IVD", id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", }, { db: "CNVD", id: "CNVD-2017-22829", }, ], trust: 0.08, }, iot_taxonomy: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { category: [ "ICS", ], sub_category: null, trust: 0.8, }, ], sources: [ { db: "IVD", id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", }, { db: "CNVD", id: "CNVD-2017-22829", }, ], }, last_update_date: "2024-11-23T22:00:54.843000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "Security Best Practices Checklists for Building Automation Systems (BAS)", trust: 0.8, url: "http://www.automatedlogic.com/Pages/Security.aspx", }, { title: "ALC WebCTRL i-Vu/SiteScan Web Path Traversal Vulnerability Patch", trust: 0.6, url: "https://www.cnvd.org.cn/patchInfo/show/100836", }, { title: "ALC WebCTRL , i-Vu and SiteScan Web Repair measures for path traversal vulnerabilities", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99872", }, ], sources: [ { db: "CNVD", id: "CNVD-2017-22829", }, { db: "JVNDB", id: "JVNDB-2017-007643", }, { db: "CNNVD", id: "CNNVD-201706-863", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-22", trust: 1.8, }, ], sources: [ { db: "JVNDB", id: "JVNDB-2017-007643", }, { db: "NVD", id: "CVE-2017-9640", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 3, url: "https://ics-cert.us-cert.gov/advisories/icsa-17-234-01", }, { trust: 1.8, url: "http://www.securityfocus.com/bid/100452", }, { trust: 1.7, url: "https://www.exploit-db.com/exploits/42543/", }, { trust: 1, url: "https://nvd.nist.gov/vuln/detail/cve-2017-9640", }, { trust: 1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9640", }, { trust: 0.6, url: "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9640", }, { trust: 0.4, url: "http://www.automatedlogic.com", }, { trust: 0.3, url: "http://www.automatedlogic.com/pages/security_commitment.aspx", }, { trust: 0.3, url: "http://www.automatedlogic.com/specsheets/security_best_practices_checklists_for_building_automation_systems_(bas)pdf.pdf", }, { trust: 0.3, url: "http://www.securityweek.com/automated-logic-patches-flaws-building-automation-system", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2017-9650", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9650", }, { trust: 0.1, url: "https://www.exploit-db.com/exploits/42544/", }, { trust: 0.1, url: "https://packetstormsecurity.com/files/143897", }, { trust: 0.1, url: "https://cxsecurity.com/issue/wlb-2017080166", }, { trust: 0.1, url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/130767", }, { trust: 0.1, url: "http://www.vfocus.net/art/20170824/13802.html", }, { trust: 0.1, url: "https://cxsecurity.com/issue/wlb-2017080165", }, { trust: 0.1, url: "https://packetstormsecurity.com/files/143896", }, { trust: 0.1, url: "https://www.auscert.org.au/bulletins/51482", }, { trust: 0.1, url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/130766", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2017-9644", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9644", }, { trust: 0.1, url: "https://packetstormsecurity.com/files/143895", }, { trust: 0.1, url: "https://cxsecurity.com/issue/wlb-2017080167", }, { trust: 0.1, url: "https://www.exploit-db.com/exploits/42542/", }, { trust: 0.1, url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/130760", }, { trust: 0.1, url: "http://www.securityfocus.com/bid/100454", }, { trust: 0.1, url: "http://target/touch.txt", }, { trust: 0.1, url: "https://www.zeroscience.mk/en/vulnerabilities/zsl-2017-5430.php", }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "CNVD", id: "CNVD-2017-22829", }, { db: "BID", id: "100452", }, { db: "JVNDB", id: "JVNDB-2017-007643", }, { db: "PACKETSTORM", id: "143896", }, { db: "CNNVD", id: "CNNVD-201706-863", }, { db: "NVD", id: "CVE-2017-9640", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", }, { db: "CNVD", id: "CNVD-2017-22829", }, { db: "BID", id: "100452", }, { db: "JVNDB", id: "JVNDB-2017-007643", }, { db: "PACKETSTORM", id: "143896", }, { db: "CNNVD", id: "CNNVD-201706-863", }, { db: "NVD", id: "CVE-2017-9640", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2017-08-22T00:00:00", db: "ZSL", id: "ZSL-2017-5431", }, { date: "2017-08-22T00:00:00", db: "ZSL", id: "ZSL-2017-5430", }, { date: "2017-08-22T00:00:00", db: "ZSL", id: "ZSL-2017-5429", }, { date: "2017-08-25T00:00:00", db: "IVD", id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", }, { date: "2017-08-25T00:00:00", db: "CNVD", id: "CNVD-2017-22829", }, { date: "2017-08-22T00:00:00", db: "BID", id: "100452", }, { date: "2017-09-27T00:00:00", db: "JVNDB", id: "JVNDB-2017-007643", }, { date: "2017-08-23T07:06:24", db: "PACKETSTORM", id: "143896", }, { date: "2017-06-21T00:00:00", db: "CNNVD", id: "CNNVD-201706-863", }, { date: "2017-08-25T19:29:00.410000", db: "NVD", id: "CVE-2017-9640", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2017-08-28T00:00:00", db: "ZSL", id: "ZSL-2017-5431", }, { date: "2017-08-25T00:00:00", db: "ZSL", id: "ZSL-2017-5430", }, { date: "2017-08-25T00:00:00", db: "ZSL", id: "ZSL-2017-5429", }, { date: "2017-08-25T00:00:00", db: "CNVD", id: "CNVD-2017-22829", }, { date: "2017-08-22T00:00:00", db: "BID", id: "100452", }, { date: "2017-09-27T00:00:00", db: "JVNDB", id: "JVNDB-2017-007643", }, { date: "2019-10-17T00:00:00", db: "CNNVD", id: "CNNVD-201706-863", }, { date: "2024-11-21T03:36:34.267000", db: "NVD", id: "CVE-2017-9640", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "remote", sources: [ { db: "CNNVD", id: "CNNVD-201706-863", }, ], trust: 0.6, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "ALC WebCTRL i-Vu/SiteScan Web Path traversal vulnerability", sources: [ { db: "IVD", id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", }, { db: "CNVD", id: "CNVD-2017-22829", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Path traversal", sources: [ { db: "IVD", id: "f06fbadd-bae1-46a3-8a6f-c5a536b9697e", }, { db: "CNNVD", id: "CNNVD-201706-863", }, ], trust: 0.8, }, }
var-201708-1403
Vulnerability from variot
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to upload a malicious file allowing the execution of arbitrary code. ALC WebCTRL , i-Vu ,and SiteScan Web Contains a vulnerability related to unlimited uploads of dangerous types of files.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ALC WebCTRL is a building automation platform. Multiple Automated Logic Corporation Products are prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability. WebCTRL®, Automated Logic's web-based building automationsystem, is known for its intuitive user interface and powerful integrationcapabilities. It allows building operators to optimize and manageall of their building systems - including HVAC, lighting, fire, elevators,and security - all within a single HVAC controls platform. It's everythingthey need to keep occupants comfortable, manage energy conservation measures,identify key operational problems, and validate the results.WebCTRL suffers from an authenticated arbitrary code execution vulnerability. The issue is caused due to the improper verification when uploading Add-on (.addons or .war) files using the uploadwarfile servlet. Additionaly, an improper authorization access control occurs when using the 'anonymous' user. By specification, the anonymous user should not have permissions or authorization to upload or install add-ons. The anonymous user was removed from version 6.5 of WebCTRL.Tested on: Microsoft Windows 7 Professional (6.1.7601 Service Pack 1 Build 7601)Apache-Coyote/1.1Apache Tomcat/7.0.42CJServer/1.1Java/1.7.0_25-b17Java HotSpot Server VM 23.25-b01Ant 1.7.0Axis 1.4Trove 2.0.2Xalan Java 2.4.1Xerces-J 2.6.1. The vulnerability exist due to the improper permissions,with the 'M' flag (Modify) or 'C' flag (Change) for 'Authenticated Users' group.The application suffers from an unquoted search path issue as well impacting the service'WebCTRL Service' for Windows deployed as part of WebCTRL server solution. This couldpotentially allow an authorized but non-privileged local user to execute arbitrarycode with elevated privileges on the system. A successful attempt would require thelocal user to be able to insert their code in the system root path undetected by theOS or other security applications where it could potentially be executed duringapplication startup or reboot. If successful, the local user’s code would executewith the elevated privileges of the application.Tested on: Microsoft Windows 7 Professional SP1 (EN)
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201708-1403", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: null, scope: "eq", trust: 1, vendor: "webctrl", version: "*", }, { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.5", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.1", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "6.5", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.5", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "5.2", }, { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.5", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "6.0", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "5.5", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.2", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "6.1", }, { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.2", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.5", }, { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.0", }, { model: null, scope: "eq", trust: 0.8, vendor: "i vu", version: "*", }, { model: null, scope: "eq", trust: 0.8, vendor: "sitescan web", version: "*", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.2", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.5", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.0", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.2", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.5", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.1", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.2", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.5", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.0", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.1", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: "sitescan web", scope: "lte", trust: 0.6, vendor: "ibm automated logic", version: "<=6.5", }, { model: "alc webctrl i-vu", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.0", }, { model: "alc webctrl sitescan web", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.1", }, { model: "sitescan web i-vu alc webctrl", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.5", }, { model: "sitescan web i-vu alc webctrl", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=5.5", }, { model: "sitescan web i-vu alc webctrl", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=5.2", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.0", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.5", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.2", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.5", }, { model: "webctrl", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.1", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.5", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.1", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.2", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.5", }, { model: "webctrl", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.0", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " sitescan web 6.1 and prior", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " i-vu 6.0 and prior", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " sitescan web 5.5 and prior", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " sitescan web 5.2 and prior", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1 and 6.0", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.0", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.0", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: "webctrl", scope: "lte", trust: 0.2, vendor: "automated logic", version: " sitescan web 6.5 and prior", }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "76d5e604-c8b4-41c9-80ab-9973ddaca935", }, { db: "CNVD", id: "CNVD-2017-22827", }, { db: "BID", id: "100452", }, { db: "JVNDB", id: "JVNDB-2017-007660", }, { db: "CNNVD", id: "CNNVD-201706-587", }, { db: "NVD", id: "CVE-2017-9650", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { cpe_match: [ { cpe22Uri: "cpe:/a:automatedlogic:i-vu", vulnerable: true, }, { cpe22Uri: "cpe:/a:automatedlogic:sitescan_web", vulnerable: true, }, { cpe22Uri: "cpe:/a:automatedlogic:webctrl", vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "JVNDB", id: "JVNDB-2017-007660", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Vulnerability discovered by Gjoko Krstic", sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, ], trust: 0.3, }, cve: "CVE-2017-9650", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", author: "nvd@nist.gov", availabilityImpact: "PARTIAL", baseScore: 4.6, confidentialityImpact: "PARTIAL", exploitabilityScore: 3.9, id: "CVE-2017-9650", impactScore: 6.4, integrityImpact: "PARTIAL", severity: "MEDIUM", trust: 1.8, vectorString: "AV:L/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", author: "CNVD", availabilityImpact: "NONE", baseScore: 6.6, confidentialityImpact: "COMPLETE", exploitabilityScore: 3.9, id: "CNVD-2017-22827", impactScore: 9.2, integrityImpact: "COMPLETE", severity: "MEDIUM", trust: 0.6, vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:N", version: "2.0", }, { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", author: "IVD", availabilityImpact: "NONE", baseScore: 6.6, confidentialityImpact: "COMPLETE", exploitabilityScore: 3.9, id: "76d5e604-c8b4-41c9-80ab-9973ddaca935", impactScore: 9.2, integrityImpact: "COMPLETE", severity: "MEDIUM", trust: 0.2, vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:N", version: "2.9 [IVD]", }, ], cvssV3: [ { attackComplexity: "LOW", attackVector: "LOCAL", author: "nvd@nist.gov", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", exploitabilityScore: 1.8, id: "CVE-2017-9650", impactScore: 5.9, integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", trust: 1.8, userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, ], severity: [ { author: "nvd@nist.gov", id: "CVE-2017-9650", trust: 1, value: "HIGH", }, { author: "NVD", id: "CVE-2017-9650", trust: 0.8, value: "High", }, { author: "CNVD", id: "CNVD-2017-22827", trust: 0.6, value: "MEDIUM", }, { author: "CNNVD", id: "CNNVD-201706-587", trust: 0.6, value: "HIGH", }, { author: "IVD", id: "76d5e604-c8b4-41c9-80ab-9973ddaca935", trust: 0.2, value: "HIGH", }, { author: "ZSL", id: "ZSL-2017-5431", trust: 0.1, value: "(4/5)", }, { author: "ZSL", id: "ZSL-2017-5430", trust: 0.1, value: "(3/5)", }, { author: "ZSL", id: "ZSL-2017-5429", trust: 0.1, value: "(3/5)", }, ], }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "76d5e604-c8b4-41c9-80ab-9973ddaca935", }, { db: "CNVD", id: "CNVD-2017-22827", }, { db: "JVNDB", id: "JVNDB-2017-007660", }, { db: "CNNVD", id: "CNNVD-201706-587", }, { db: "NVD", id: "CVE-2017-9650", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to upload a malicious file allowing the execution of arbitrary code. ALC WebCTRL , i-Vu ,and SiteScan Web Contains a vulnerability related to unlimited uploads of dangerous types of files.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ALC WebCTRL is a building automation platform. Multiple Automated Logic Corporation Products are prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability. WebCTRL®, Automated Logic's web-based building automationsystem, is known for its intuitive user interface and powerful integrationcapabilities. It allows building operators to optimize and manageall of their building systems - including HVAC, lighting, fire, elevators,and security - all within a single HVAC controls platform. It's everythingthey need to keep occupants comfortable, manage energy conservation measures,identify key operational problems, and validate the results.WebCTRL suffers from an authenticated arbitrary code execution vulnerability. The issue is caused due to the improper verification when uploading Add-on (.addons or .war) files using the uploadwarfile servlet. Additionaly, an improper authorization access control occurs when using the 'anonymous' user. By specification, the anonymous user should not have permissions or authorization to upload or install add-ons. The anonymous user was removed from version 6.5 of WebCTRL.Tested on: Microsoft Windows 7 Professional (6.1.7601 Service Pack 1 Build 7601)Apache-Coyote/1.1Apache Tomcat/7.0.42CJServer/1.1Java/1.7.0_25-b17Java HotSpot Server VM 23.25-b01Ant 1.7.0Axis 1.4Trove 2.0.2Xalan Java 2.4.1Xerces-J 2.6.1. The vulnerability exist due to the improper permissions,with the 'M' flag (Modify) or 'C' flag (Change) for 'Authenticated Users' group.The application suffers from an unquoted search path issue as well impacting the service'WebCTRL Service' for Windows deployed as part of WebCTRL server solution. This couldpotentially allow an authorized but non-privileged local user to execute arbitrarycode with elevated privileges on the system. A successful attempt would require thelocal user to be able to insert their code in the system root path undetected by theOS or other security applications where it could potentially be executed duringapplication startup or reboot. If successful, the local user’s code would executewith the elevated privileges of the application.Tested on: Microsoft Windows 7 Professional SP1 (EN)", sources: [ { db: "NVD", id: "CVE-2017-9650", }, { db: "JVNDB", id: "JVNDB-2017-007660", }, { db: "CNVD", id: "CNVD-2017-22827", }, { db: "BID", id: "100452", }, { db: "IVD", id: "76d5e604-c8b4-41c9-80ab-9973ddaca935", }, { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, ], trust: 2.88, }, exploit_availability: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { reference: "http://www.automatedlogic.com/pages/security.aspx", trust: 0.3, type: "poc", }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, ], }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "ICS CERT", id: "ICSA-17-234-01", trust: 3.6, }, { db: "NVD", id: "CVE-2017-9650", trust: 3.6, }, { db: "BID", id: "100452", trust: 2.1, }, { db: "EXPLOIT-DB", id: "42544", trust: 1.7, }, { db: "CNVD", id: "CNVD-2017-22827", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-201706-587", trust: 0.8, }, { db: "JVNDB", id: "JVNDB-2017-007660", trust: 0.8, }, { db: "IVD", id: "76D5E604-C8B4-41C9-80AB-9973DDACA935", trust: 0.2, }, { db: "PACKETSTORM", id: "143897", trust: 0.1, }, { db: "CXSECURITY", id: "WLB-2017080166", trust: 0.1, }, { db: "ZSL", id: "ZSL-2017-5431", trust: 0.1, }, { db: "AUSCERT", id: "ESB-2017.2113", trust: 0.1, }, { db: "EXPLOIT-DB", id: "42543", trust: 0.1, }, { db: "PACKETSTORM", id: "143896", trust: 0.1, }, { db: "NVD", id: "CVE-2017-9640", trust: 0.1, }, { db: "CXSECURITY", id: "WLB-2017080165", trust: 0.1, }, { db: "ZSL", id: "ZSL-2017-5430", trust: 0.1, }, { db: "CXSECURITY", id: "WLB-2017080167", trust: 0.1, }, { db: "NVD", id: "CVE-2017-9644", trust: 0.1, }, { db: "BID", id: "100454", trust: 0.1, }, { db: "EXPLOIT-DB", id: "42542", trust: 0.1, }, { db: "PACKETSTORM", id: "143895", trust: 0.1, }, { db: "ZSL", id: "ZSL-2017-5429", trust: 0.1, }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "76d5e604-c8b4-41c9-80ab-9973ddaca935", }, { db: "CNVD", id: "CNVD-2017-22827", }, { db: "BID", id: "100452", }, { db: "JVNDB", id: "JVNDB-2017-007660", }, { db: "CNNVD", id: "CNNVD-201706-587", }, { db: "NVD", id: "CVE-2017-9650", }, ], }, id: "VAR-201708-1403", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "IVD", id: "76d5e604-c8b4-41c9-80ab-9973ddaca935", }, { db: "CNVD", id: "CNVD-2017-22827", }, ], trust: 0.08, }, iot_taxonomy: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { category: [ "ICS", ], sub_category: null, trust: 0.8, }, ], sources: [ { db: "IVD", id: "76d5e604-c8b4-41c9-80ab-9973ddaca935", }, { db: "CNVD", id: "CNVD-2017-22827", }, ], }, last_update_date: "2024-11-23T22:00:54.729000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "Security Best Practices Checklists for Building Automation Systems (BAS)", trust: 0.8, url: "http://www.automatedlogic.com/Pages/Security.aspx", }, { title: "ALC WebCTRL i-Vu/SiteScan Web File Unrestricted File Upload Vulnerability Patch", trust: 0.6, url: "https://www.cnvd.org.cn/patchInfo/show/100835", }, { title: "ALC WebCTRL , i-Vu and SiteScan Web Security vulnerabilities", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99851", }, ], sources: [ { db: "CNVD", id: "CNVD-2017-22827", }, { db: "JVNDB", id: "JVNDB-2017-007660", }, { db: "CNNVD", id: "CNNVD-201706-587", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-434", trust: 1.8, }, ], sources: [ { db: "JVNDB", id: "JVNDB-2017-007660", }, { db: "NVD", id: "CVE-2017-9650", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 3.6, url: "https://ics-cert.us-cert.gov/advisories/icsa-17-234-01", }, { trust: 1.8, url: "http://www.securityfocus.com/bid/100452", }, { trust: 1.7, url: "https://www.exploit-db.com/exploits/42544/", }, { trust: 0.9, url: "https://nvd.nist.gov/vuln/detail/cve-2017-9650", }, { trust: 0.9, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9650", }, { trust: 0.6, url: "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9650", }, { trust: 0.3, url: "http://www.automatedlogic.com/pages/security_commitment.aspx", }, { trust: 0.3, url: "http://www.automatedlogic.com/specsheets/security_best_practices_checklists_for_building_automation_systems_(bas)pdf.pdf", }, { trust: 0.3, url: "http://www.securityweek.com/automated-logic-patches-flaws-building-automation-system", }, { trust: 0.3, url: "http://www.automatedlogic.com", }, { trust: 0.1, url: "https://packetstormsecurity.com/files/143897", }, { trust: 0.1, url: "https://cxsecurity.com/issue/wlb-2017080166", }, { trust: 0.1, url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/130767", }, { trust: 0.1, url: "http://www.vfocus.net/art/20170824/13802.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2017-9640", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9640", }, { trust: 0.1, url: "https://www.exploit-db.com/exploits/42543/", }, { trust: 0.1, url: "https://cxsecurity.com/issue/wlb-2017080165", }, { trust: 0.1, url: "https://packetstormsecurity.com/files/143896", }, { trust: 0.1, url: "https://www.auscert.org.au/bulletins/51482", }, { trust: 0.1, url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/130766", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2017-9644", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9644", }, { trust: 0.1, url: "https://packetstormsecurity.com/files/143895", }, { trust: 0.1, url: "https://cxsecurity.com/issue/wlb-2017080167", }, { trust: 0.1, url: "https://www.exploit-db.com/exploits/42542/", }, { trust: 0.1, url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/130760", }, { trust: 0.1, url: "http://www.securityfocus.com/bid/100454", }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "CNVD", id: "CNVD-2017-22827", }, { db: "BID", id: "100452", }, { db: "JVNDB", id: "JVNDB-2017-007660", }, { db: "CNNVD", id: "CNNVD-201706-587", }, { db: "NVD", id: "CVE-2017-9650", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "76d5e604-c8b4-41c9-80ab-9973ddaca935", }, { db: "CNVD", id: "CNVD-2017-22827", }, { db: "BID", id: "100452", }, { db: "JVNDB", id: "JVNDB-2017-007660", }, { db: "CNNVD", id: "CNNVD-201706-587", }, { db: "NVD", id: "CVE-2017-9650", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2017-08-22T00:00:00", db: "ZSL", id: "ZSL-2017-5431", }, { date: "2017-08-22T00:00:00", db: "ZSL", id: "ZSL-2017-5430", }, { date: "2017-08-22T00:00:00", db: "ZSL", id: "ZSL-2017-5429", }, { date: "2017-08-25T00:00:00", db: "IVD", id: "76d5e604-c8b4-41c9-80ab-9973ddaca935", }, { date: "2017-08-25T00:00:00", db: "CNVD", id: "CNVD-2017-22827", }, { date: "2017-08-22T00:00:00", db: "BID", id: "100452", }, { date: "2017-09-28T00:00:00", db: "JVNDB", id: "JVNDB-2017-007660", }, { date: "2017-06-15T00:00:00", db: "CNNVD", id: "CNNVD-201706-587", }, { date: "2017-08-25T19:29:00.487000", db: "NVD", id: "CVE-2017-9650", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2017-08-28T00:00:00", db: "ZSL", id: "ZSL-2017-5431", }, { date: "2017-08-25T00:00:00", db: "ZSL", id: "ZSL-2017-5430", }, { date: "2017-08-25T00:00:00", db: "ZSL", id: "ZSL-2017-5429", }, { date: "2017-08-25T00:00:00", db: "CNVD", id: "CNVD-2017-22827", }, { date: "2017-08-22T00:00:00", db: "BID", id: "100452", }, { date: "2017-09-28T00:00:00", db: "JVNDB", id: "JVNDB-2017-007660", }, { date: "2019-10-17T00:00:00", db: "CNNVD", id: "CNNVD-201706-587", }, { date: "2024-11-21T03:36:35.230000", db: "NVD", id: "CVE-2017-9650", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "local", sources: [ { db: "CNNVD", id: "CNNVD-201706-587", }, ], trust: 0.6, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "plural ALC Product unrestricted upload vulnerability", sources: [ { db: "JVNDB", id: "JVNDB-2017-007660", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Code problem", sources: [ { db: "IVD", id: "76d5e604-c8b4-41c9-80ab-9973ddaca935", }, { db: "CNNVD", id: "CNNVD-201706-587", }, ], trust: 0.8, }, }
var-201708-0163
Vulnerability from variot
An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and prior. An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network. ALC WebCTRL , i-Vu ,and SiteScan Web Is XML An external entity vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. AutomatedLogic provides a complete set of building electrical and mechanical control systems for the majority of users, including central air conditioning automatic control, power distribution monitoring, water supply and drainage monitoring, lighting monitoring and elevator monitoring. The system has been widely used in the United States, China and other regions. There are XML external entity vulnerabilities in multiple devices of AutomatedLogicCorporation. Attackers can exploit this issue to gain access to sensitive information or cause denial-of-service condition
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201708-0163", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.5", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "6.5", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.5", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: "carrier i-vu", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.5", }, { model: "alc webctrl", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.5", }, { model: "liebert sitescan web", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.5", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.5", }, { model: "webctrl", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.5", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.5", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.0", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.0", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: null, scope: "eq", trust: 0.2, vendor: "i vu", version: "*", }, { model: null, scope: "eq", trust: 0.2, vendor: "sitescan web", version: "*", }, { model: null, scope: "eq", trust: 0.2, vendor: "webctrl", version: "*", }, ], sources: [ { db: "IVD", id: "52ef8bd8-d974-45fb-aa99-07306c190de3", }, { db: "CNVD", id: "CNVD-2017-24364", }, { db: "BID", id: "100558", }, { db: "JVNDB", id: "JVNDB-2016-008818", }, { db: "CNNVD", id: "CNNVD-201708-1409", }, { db: "NVD", id: "CVE-2016-5795", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { cpe_match: [ { cpe22Uri: "cpe:/a:automatedlogic:i-vu", vulnerable: true, }, { cpe22Uri: "cpe:/a:automatedlogic:sitescan_web", vulnerable: true, }, { cpe22Uri: "cpe:/a:automatedlogic:webctrl", vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "JVNDB", id: "JVNDB-2016-008818", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Evgeny Ermakov from Kaspersky Lab.", sources: [ { db: "BID", id: "100558", }, ], trust: 0.3, }, cve: "CVE-2016-5795", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "nvd@nist.gov", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", exploitabilityScore: 10, id: "CVE-2016-5795", impactScore: 6.4, integrityImpact: "PARTIAL", severity: "HIGH", trust: 1.8, vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "CNVD", availabilityImpact: "PARTIAL", baseScore: 6.4, confidentialityImpact: "PARTIAL", exploitabilityScore: 10, id: "CNVD-2017-24364", impactScore: 4.9, integrityImpact: "NONE", severity: "MEDIUM", trust: 0.6, vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:P", version: "2.0", }, { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "IVD", availabilityImpact: "PARTIAL", baseScore: 6.4, confidentialityImpact: "PARTIAL", exploitabilityScore: 10, id: "52ef8bd8-d974-45fb-aa99-07306c190de3", impactScore: 4.9, integrityImpact: "NONE", severity: "MEDIUM", trust: 0.2, vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:P", version: "2.9 [IVD]", }, ], cvssV3: [ { attackComplexity: "LOW", attackVector: "NETWORK", author: "nvd@nist.gov", availabilityImpact: "LOW", baseScore: 7.3, baseSeverity: "HIGH", confidentialityImpact: "LOW", exploitabilityScore: 3.9, id: "CVE-2016-5795", impactScore: 3.4, integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", trust: 1.8, userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", version: "3.0", }, ], severity: [ { author: "nvd@nist.gov", id: "CVE-2016-5795", trust: 1, value: "HIGH", }, { author: "NVD", id: "CVE-2016-5795", trust: 0.8, value: "High", }, { author: "CNVD", id: "CNVD-2017-24364", trust: 0.6, value: "MEDIUM", }, { author: "CNNVD", id: "CNNVD-201708-1409", trust: 0.6, value: "HIGH", }, { author: "IVD", id: "52ef8bd8-d974-45fb-aa99-07306c190de3", trust: 0.2, value: "HIGH", }, ], }, ], sources: [ { db: "IVD", id: "52ef8bd8-d974-45fb-aa99-07306c190de3", }, { db: "CNVD", id: "CNVD-2017-24364", }, { db: "JVNDB", id: "JVNDB-2016-008818", }, { db: "CNNVD", id: "CNNVD-201708-1409", }, { db: "NVD", id: "CVE-2016-5795", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and prior. An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network. ALC WebCTRL , i-Vu ,and SiteScan Web Is XML An external entity vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. AutomatedLogic provides a complete set of building electrical and mechanical control systems for the majority of users, including central air conditioning automatic control, power distribution monitoring, water supply and drainage monitoring, lighting monitoring and elevator monitoring. The system has been widely used in the United States, China and other regions. There are XML external entity vulnerabilities in multiple devices of AutomatedLogicCorporation. \nAttackers can exploit this issue to gain access to sensitive information or cause denial-of-service condition", sources: [ { db: "NVD", id: "CVE-2016-5795", }, { db: "JVNDB", id: "JVNDB-2016-008818", }, { db: "CNVD", id: "CNVD-2017-24364", }, { db: "BID", id: "100558", }, { db: "IVD", id: "52ef8bd8-d974-45fb-aa99-07306c190de3", }, ], trust: 2.61, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2016-5795", trust: 3.5, }, { db: "ICS CERT", id: "ICSA-17-150-01", trust: 3.3, }, { db: "BID", id: "100558", trust: 1.9, }, { db: "CNVD", id: "CNVD-2017-24364", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-201708-1409", trust: 0.8, }, { db: "JVNDB", id: "JVNDB-2016-008818", trust: 0.8, }, { db: "IVD", id: "52EF8BD8-D974-45FB-AA99-07306C190DE3", trust: 0.2, }, ], sources: [ { db: "IVD", id: "52ef8bd8-d974-45fb-aa99-07306c190de3", }, { db: "CNVD", id: "CNVD-2017-24364", }, { db: "BID", id: "100558", }, { db: "JVNDB", id: "JVNDB-2016-008818", }, { db: "CNNVD", id: "CNNVD-201708-1409", }, { db: "NVD", id: "CVE-2016-5795", }, ], }, id: "VAR-201708-0163", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "IVD", id: "52ef8bd8-d974-45fb-aa99-07306c190de3", }, { db: "CNVD", id: "CNVD-2017-24364", }, ], trust: 0.08, }, iot_taxonomy: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { category: [ "ICS", "Network device", ], sub_category: null, trust: 0.6, }, { category: [ "ICS", ], sub_category: null, trust: 0.2, }, ], sources: [ { db: "IVD", id: "52ef8bd8-d974-45fb-aa99-07306c190de3", }, { db: "CNVD", id: "CNVD-2017-24364", }, ], }, last_update_date: "2024-11-23T22:56:10.467000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "Top Page", trust: 0.8, url: "http://www.automatedlogic.com/", }, { title: "AutomatedLogicCorporation Patch for Multiple Device XML External Entity Vulnerabilities", trust: 0.6, url: "https://www.cnvd.org.cn/patchInfo/show/101402", }, { title: "ALC Liebert SiteScan Web , ALC WebCTRL and Carrier i-Vu Fixes for cross-site scripting vulnerabilities", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74504", }, ], sources: [ { db: "CNVD", id: "CNVD-2017-24364", }, { db: "JVNDB", id: "JVNDB-2016-008818", }, { db: "CNNVD", id: "CNNVD-201708-1409", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-611", trust: 1.8, }, ], sources: [ { db: "JVNDB", id: "JVNDB-2016-008818", }, { db: "NVD", id: "CVE-2016-5795", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 3.3, url: "https://ics-cert.us-cert.gov/advisories/icsa-17-150-01", }, { trust: 1.6, url: "http://www.securityfocus.com/bid/100558", }, { trust: 0.8, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-5795", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2016-5795", }, { trust: 0.3, url: "http://www.automatedlogic.com", }, ], sources: [ { db: "CNVD", id: "CNVD-2017-24364", }, { db: "BID", id: "100558", }, { db: "JVNDB", id: "JVNDB-2016-008818", }, { db: "CNNVD", id: "CNNVD-201708-1409", }, { db: "NVD", id: "CVE-2016-5795", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "IVD", id: "52ef8bd8-d974-45fb-aa99-07306c190de3", }, { db: "CNVD", id: "CNVD-2017-24364", }, { db: "BID", id: "100558", }, { db: "JVNDB", id: "JVNDB-2016-008818", }, { db: "CNNVD", id: "CNNVD-201708-1409", }, { db: "NVD", id: "CVE-2016-5795", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2017-09-02T00:00:00", db: "IVD", id: "52ef8bd8-d974-45fb-aa99-07306c190de3", }, { date: "2017-09-01T00:00:00", db: "CNVD", id: "CNVD-2017-24364", }, { date: "2017-08-31T00:00:00", db: "BID", id: "100558", }, { date: "2017-09-28T00:00:00", db: "JVNDB", id: "JVNDB-2016-008818", }, { date: "2017-08-31T00:00:00", db: "CNNVD", id: "CNNVD-201708-1409", }, { date: "2017-08-31T21:29:00.187000", db: "NVD", id: "CVE-2016-5795", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2017-09-02T00:00:00", db: "CNVD", id: "CNVD-2017-24364", }, { date: "2017-08-31T00:00:00", db: "BID", id: "100558", }, { date: "2017-09-28T00:00:00", db: "JVNDB", id: "JVNDB-2016-008818", }, { date: "2021-08-02T00:00:00", db: "CNNVD", id: "CNNVD-201708-1409", }, { date: "2024-11-21T02:55:01.433000", db: "NVD", id: "CVE-2016-5795", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "remote", sources: [ { db: "CNNVD", id: "CNNVD-201708-1409", }, ], trust: 0.6, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "plural ALC In product XML External entity vulnerabilities", sources: [ { db: "JVNDB", id: "JVNDB-2016-008818", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "code problem", sources: [ { db: "CNNVD", id: "CNNVD-201708-1409", }, ], trust: 0.6, }, }
var-201708-1399
Vulnerability from variot
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An unquoted search path vulnerability may allow a non-privileged local attacker to change files in the installation directory and execute arbitrary code with elevated privileges. ALC WebCTRL , i-Vu ,and SiteScan Web Contains vulnerabilities related to unquoted search paths or elements.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ALC WebCTRL is a building automation platform. Multiple Automated Logic Corporation (ALC) Products are prone to local privilege-escalation vulnerability. WebCTRL®, Automated Logic's web-based building automationsystem, is known for its intuitive user interface and powerful integrationcapabilities. It allows building operators to optimize and manageall of their building systems - including HVAC, lighting, fire, elevators,and security - all within a single HVAC controls platform. It's everythingthey need to keep occupants comfortable, manage energy conservation measures,identify key operational problems, and validate the results.WebCTRL suffers from an authenticated arbitrary code execution vulnerability. The issue is caused due to the improper verification when uploading Add-on (.addons or .war) files using the uploadwarfile servlet. This can be exploited to execute arbitrary code by uploading a malicious web archive file that will run automatically and can be accessed from within the webroot directory. Additionaly, an improper authorization access control occurs when using the 'anonymous' user. By specification, the anonymous user should not have permissions or authorization to upload or install add-ons. In this case, when using the anonymous user, an attacker is still able to upload a malicious file via insecure direct object reference and execute arbitrary code. The anonymous user was removed from version 6.5 of WebCTRL.Tested on: Microsoft Windows 7 Professional (6.1.7601 Service Pack 1 Build 7601)Apache-Coyote/1.1Apache Tomcat/7.0.42CJServer/1.1Java/1.7.0_25-b17Java HotSpot Server VM 23.25-b01Ant 1.7.0Axis 1.4Trove 2.0.2Xalan Java 2.4.1Xerces-J 2.6.1. The vulnerability exist due to the improper permissions,with the 'M' flag (Modify) or 'C' flag (Change) for 'Authenticated Users' group.The application suffers from an unquoted search path issue as well impacting the service'WebCTRL Service' for Windows deployed as part of WebCTRL server solution. A successful attempt would require thelocal user to be able to insert their code in the system root path undetected by theOS or other security applications where it could potentially be executed duringapplication startup or reboot
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201708-1399", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: null, scope: "eq", trust: 1, vendor: "webctrl", version: "*", }, { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.5", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.1", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "6.5", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.5", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "5.2", }, { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.5", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "6.0", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "5.5", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.2", }, { model: "automatedlogic webctrl", scope: "lte", trust: 1, vendor: "carrier", version: "6.1", }, { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.2", }, { model: "sitescan web", scope: "lte", trust: 1, vendor: "automatedlogic", version: "5.5", }, { model: "i-vu", scope: "lte", trust: 1, vendor: "automatedlogic", version: "6.0", }, { model: null, scope: "eq", trust: 0.8, vendor: "i vu", version: "*", }, { model: null, scope: "eq", trust: 0.8, vendor: "sitescan web", version: "*", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.2", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.5", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.0", }, { model: "i-vu", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.2", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.5", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.1", }, { model: "sitescan web", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.2", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "5.5", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.0", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.1", }, { model: "webctrl", scope: "lte", trust: 0.8, vendor: "automated logic", version: "6.5", }, { model: "sitescan web", scope: "lte", trust: 0.6, vendor: "ibm automated logic", version: "<=6.5", }, { model: "alc webctrl i-vu", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.0", }, { model: "alc webctrl sitescan web", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.1", }, { model: "sitescan web i-vu alc webctrl", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=6.5", }, { model: "sitescan web i-vu alc webctrl", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=5.5", }, { model: "sitescan web i-vu alc webctrl", scope: "lte", trust: 0.6, vendor: "automated logic", version: "<=5.2", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.0", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.2", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.5", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.5", }, { model: "webctrl", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.5", }, { model: "webctrl", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.2", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.5", }, { model: "sitescan web", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "6.1", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.2", }, { model: "i-vu", scope: "eq", trust: 0.6, vendor: "automatedlogic", version: "5.5", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " sitescan web 6.1 and prior", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " i-vu 6.0 and prior", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " sitescan web 5.5 and prior", }, { model: "webctrl", scope: "lte", trust: 0.3, vendor: "automated logic", version: " sitescan web 5.2 and prior", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1 and 6.0", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.0", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "webctrl", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.1", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "sitescan web", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.5", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "6.0", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.5", }, { model: "i-vu", scope: "eq", trust: 0.3, vendor: "automated logic", version: "5.2", }, { model: "webctrl", scope: "lte", trust: 0.2, vendor: "automated logic", version: " sitescan web 6.5 and prior", }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", }, { db: "CNVD", id: "CNVD-2017-22828", }, { db: "BID", id: "100454", }, { db: "JVNDB", id: "JVNDB-2017-007644", }, { db: "CNNVD", id: "CNNVD-201706-859", }, { db: "NVD", id: "CVE-2017-9644", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { cpe_match: [ { cpe22Uri: "cpe:/a:automatedlogic:i-vu", vulnerable: true, }, { cpe22Uri: "cpe:/a:automatedlogic:sitescan_web", vulnerable: true, }, { cpe22Uri: "cpe:/a:automatedlogic:webctrl", vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "JVNDB", id: "JVNDB-2017-007644", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Vulnerability discovered by Gjoko Krstic", sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, ], trust: 0.3, }, cve: "CVE-2017-9644", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { accessComplexity: "MEDIUM", accessVector: "LOCAL", authentication: "NONE", author: "nvd@nist.gov", availabilityImpact: "COMPLETE", baseScore: 6.9, confidentialityImpact: "COMPLETE", exploitabilityScore: 3.4, id: "CVE-2017-9644", impactScore: 10, integrityImpact: "COMPLETE", severity: "MEDIUM", trust: 1.8, vectorString: "AV:L/AC:M/Au:N/C:C/I:C/A:C", version: "2.0", }, { accessComplexity: "HIGH", accessVector: "LOCAL", authentication: "NONE", author: "CNVD", availabilityImpact: "COMPLETE", baseScore: 6.2, confidentialityImpact: "COMPLETE", exploitabilityScore: 1.9, id: "CNVD-2017-22828", impactScore: 10, integrityImpact: "COMPLETE", severity: "MEDIUM", trust: 0.6, vectorString: "AV:L/AC:H/Au:N/C:C/I:C/A:C", version: "2.0", }, { accessComplexity: "HIGH", accessVector: "LOCAL", authentication: "NONE", author: "IVD", availabilityImpact: "COMPLETE", baseScore: 6.2, confidentialityImpact: "COMPLETE", exploitabilityScore: 1.9, id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", impactScore: 10, integrityImpact: "COMPLETE", severity: "MEDIUM", trust: 0.2, vectorString: "AV:L/AC:H/Au:N/C:C/I:C/A:C", version: "2.9 [IVD]", }, ], cvssV3: [ { attackComplexity: "HIGH", attackVector: "LOCAL", author: "nvd@nist.gov", availabilityImpact: "HIGH", baseScore: 7, baseSeverity: "HIGH", confidentialityImpact: "HIGH", exploitabilityScore: 1, id: "CVE-2017-9644", impactScore: 5.9, integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", trust: 1.8, userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, ], severity: [ { author: "nvd@nist.gov", id: "CVE-2017-9644", trust: 1, value: "HIGH", }, { author: "NVD", id: "CVE-2017-9644", trust: 0.8, value: "High", }, { author: "CNVD", id: "CNVD-2017-22828", trust: 0.6, value: "MEDIUM", }, { author: "CNNVD", id: "CNNVD-201706-859", trust: 0.6, value: "HIGH", }, { author: "IVD", id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", trust: 0.2, value: "HIGH", }, { author: "ZSL", id: "ZSL-2017-5431", trust: 0.1, value: "(4/5)", }, { author: "ZSL", id: "ZSL-2017-5430", trust: 0.1, value: "(3/5)", }, { author: "ZSL", id: "ZSL-2017-5429", trust: 0.1, value: "(3/5)", }, ], }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", }, { db: "CNVD", id: "CNVD-2017-22828", }, { db: "JVNDB", id: "JVNDB-2017-007644", }, { db: "CNNVD", id: "CNNVD-201706-859", }, { db: "NVD", id: "CVE-2017-9644", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An unquoted search path vulnerability may allow a non-privileged local attacker to change files in the installation directory and execute arbitrary code with elevated privileges. ALC WebCTRL , i-Vu ,and SiteScan Web Contains vulnerabilities related to unquoted search paths or elements.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ALC WebCTRL is a building automation platform. Multiple Automated Logic Corporation (ALC) Products are prone to local privilege-escalation vulnerability. WebCTRL®, Automated Logic's web-based building automationsystem, is known for its intuitive user interface and powerful integrationcapabilities. It allows building operators to optimize and manageall of their building systems - including HVAC, lighting, fire, elevators,and security - all within a single HVAC controls platform. It's everythingthey need to keep occupants comfortable, manage energy conservation measures,identify key operational problems, and validate the results.WebCTRL suffers from an authenticated arbitrary code execution vulnerability. The issue is caused due to the improper verification when uploading Add-on (.addons or .war) files using the uploadwarfile servlet. This can be exploited to execute arbitrary code by uploading a malicious web archive file that will run automatically and can be accessed from within the webroot directory. Additionaly, an improper authorization access control occurs when using the 'anonymous' user. By specification, the anonymous user should not have permissions or authorization to upload or install add-ons. In this case, when using the anonymous user, an attacker is still able to upload a malicious file via insecure direct object reference and execute arbitrary code. The anonymous user was removed from version 6.5 of WebCTRL.Tested on: Microsoft Windows 7 Professional (6.1.7601 Service Pack 1 Build 7601)Apache-Coyote/1.1Apache Tomcat/7.0.42CJServer/1.1Java/1.7.0_25-b17Java HotSpot Server VM 23.25-b01Ant 1.7.0Axis 1.4Trove 2.0.2Xalan Java 2.4.1Xerces-J 2.6.1. The vulnerability exist due to the improper permissions,with the 'M' flag (Modify) or 'C' flag (Change) for 'Authenticated Users' group.The application suffers from an unquoted search path issue as well impacting the service'WebCTRL Service' for Windows deployed as part of WebCTRL server solution. A successful attempt would require thelocal user to be able to insert their code in the system root path undetected by theOS or other security applications where it could potentially be executed duringapplication startup or reboot", sources: [ { db: "NVD", id: "CVE-2017-9644", }, { db: "JVNDB", id: "JVNDB-2017-007644", }, { db: "CNVD", id: "CNVD-2017-22828", }, { db: "BID", id: "100454", }, { db: "IVD", id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", }, { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, ], trust: 2.88, }, exploit_availability: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { reference: "http://www.automatedlogic.com/pages/security.aspx", trust: 0.3, type: "poc", }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, ], }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2017-9644", trust: 3.6, }, { db: "ICS CERT", id: "ICSA-17-234-01", trust: 3, }, { db: "BID", id: "100454", trust: 2, }, { db: "EXPLOIT-DB", id: "42542", trust: 1.7, }, { db: "CNVD", id: "CNVD-2017-22828", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-201706-859", trust: 0.8, }, { db: "JVNDB", id: "JVNDB-2017-007644", trust: 0.8, }, { db: "BID", id: "100452", trust: 0.2, }, { db: "IVD", id: "963DE9F9-6E8A-4C63-8060-67B7CA4DE5CE", trust: 0.2, }, { db: "PACKETSTORM", id: "143897", trust: 0.1, }, { db: "EXPLOIT-DB", id: "42544", trust: 0.1, }, { db: "NVD", id: "CVE-2017-9650", trust: 0.1, }, { db: "CXSECURITY", id: "WLB-2017080166", trust: 0.1, }, { db: "ZSL", id: "ZSL-2017-5431", trust: 0.1, }, { db: "AUSCERT", id: "ESB-2017.2113", trust: 0.1, }, { db: "EXPLOIT-DB", id: "42543", trust: 0.1, }, { db: "PACKETSTORM", id: "143896", trust: 0.1, }, { db: "NVD", id: "CVE-2017-9640", trust: 0.1, }, { db: "CXSECURITY", id: "WLB-2017080165", trust: 0.1, }, { db: "ZSL", id: "ZSL-2017-5430", trust: 0.1, }, { db: "CXSECURITY", id: "WLB-2017080167", trust: 0.1, }, { db: "PACKETSTORM", id: "143895", trust: 0.1, }, { db: "ZSL", id: "ZSL-2017-5429", trust: 0.1, }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", }, { db: "CNVD", id: "CNVD-2017-22828", }, { db: "BID", id: "100454", }, { db: "JVNDB", id: "JVNDB-2017-007644", }, { db: "CNNVD", id: "CNNVD-201706-859", }, { db: "NVD", id: "CVE-2017-9644", }, ], }, id: "VAR-201708-1399", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "IVD", id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", }, { db: "CNVD", id: "CNVD-2017-22828", }, ], trust: 0.08, }, iot_taxonomy: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { category: [ "ICS", ], sub_category: null, trust: 0.8, }, ], sources: [ { db: "IVD", id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", }, { db: "CNVD", id: "CNVD-2017-22828", }, ], }, last_update_date: "2024-11-23T22:00:54.787000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "Security Best Practices Checklists for Building Automation Systems (BAS)", trust: 0.8, url: "http://www.automatedlogic.com/Pages/Security.aspx", }, { title: "ALC WebCTRL i-Vu/SiteScan Web does not reference patches for search path vulnerabilities", trust: 0.6, url: "https://www.cnvd.org.cn/patchInfo/show/100837", }, { title: "ALC WebCTRL , i-Vu and SiteScan Web Security vulnerabilities", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99869", }, ], sources: [ { db: "CNVD", id: "CNVD-2017-22828", }, { db: "JVNDB", id: "JVNDB-2017-007644", }, { db: "CNNVD", id: "CNNVD-201706-859", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-428", trust: 1.8, }, ], sources: [ { db: "JVNDB", id: "JVNDB-2017-007644", }, { db: "NVD", id: "CVE-2017-9644", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 3, url: "https://ics-cert.us-cert.gov/advisories/icsa-17-234-01", }, { trust: 1.7, url: "https://www.exploit-db.com/exploits/42542/", }, { trust: 1.7, url: "http://www.securityfocus.com/bid/100454", }, { trust: 0.9, url: "https://nvd.nist.gov/vuln/detail/cve-2017-9644", }, { trust: 0.9, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9644", }, { trust: 0.6, url: "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9644", }, { trust: 0.3, url: "http://www.automatedlogic.com/pages/security_commitment.aspx", }, { trust: 0.3, url: "http://www.automatedlogic.com/specsheets/security_best_practices_checklists_for_building_automation_systems_(bas)pdf.pdf", }, { trust: 0.3, url: "http://www.securityweek.com/automated-logic-patches-flaws-building-automation-system", }, { trust: 0.3, url: "http://www.automatedlogic.com", }, { trust: 0.2, url: "http://www.securityfocus.com/bid/100452", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2017-9650", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9650", }, { trust: 0.1, url: "https://www.exploit-db.com/exploits/42544/", }, { trust: 0.1, url: "https://packetstormsecurity.com/files/143897", }, { trust: 0.1, url: "https://cxsecurity.com/issue/wlb-2017080166", }, { trust: 0.1, url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/130767", }, { trust: 0.1, url: "http://www.vfocus.net/art/20170824/13802.html", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2017-9640", }, { trust: 0.1, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9640", }, { trust: 0.1, url: "https://www.exploit-db.com/exploits/42543/", }, { trust: 0.1, url: "https://cxsecurity.com/issue/wlb-2017080165", }, { trust: 0.1, url: "https://packetstormsecurity.com/files/143896", }, { trust: 0.1, url: "https://www.auscert.org.au/bulletins/51482", }, { trust: 0.1, url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/130766", }, { trust: 0.1, url: "https://packetstormsecurity.com/files/143895", }, { trust: 0.1, url: "https://cxsecurity.com/issue/wlb-2017080167", }, { trust: 0.1, url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/130760", }, ], sources: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "CNVD", id: "CNVD-2017-22828", }, { db: "BID", id: "100454", }, { db: "JVNDB", id: "JVNDB-2017-007644", }, { db: "CNNVD", id: "CNNVD-201706-859", }, { db: "NVD", id: "CVE-2017-9644", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "ZSL", id: "ZSL-2017-5431", }, { db: "ZSL", id: "ZSL-2017-5430", }, { db: "ZSL", id: "ZSL-2017-5429", }, { db: "IVD", id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", }, { db: "CNVD", id: "CNVD-2017-22828", }, { db: "BID", id: "100454", }, { db: "JVNDB", id: "JVNDB-2017-007644", }, { db: "CNNVD", id: "CNNVD-201706-859", }, { db: "NVD", id: "CVE-2017-9644", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2017-08-22T00:00:00", db: "ZSL", id: "ZSL-2017-5431", }, { date: "2017-08-22T00:00:00", db: "ZSL", id: "ZSL-2017-5430", }, { date: "2017-08-22T00:00:00", db: "ZSL", id: "ZSL-2017-5429", }, { date: "2017-08-25T00:00:00", db: "IVD", id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", }, { date: "2017-08-25T00:00:00", db: "CNVD", id: "CNVD-2017-22828", }, { date: "2017-08-23T00:00:00", db: "BID", id: "100454", }, { date: "2017-09-27T00:00:00", db: "JVNDB", id: "JVNDB-2017-007644", }, { date: "2017-06-21T00:00:00", db: "CNNVD", id: "CNNVD-201706-859", }, { date: "2017-08-25T19:29:00.457000", db: "NVD", id: "CVE-2017-9644", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2017-08-28T00:00:00", db: "ZSL", id: "ZSL-2017-5431", }, { date: "2017-08-25T00:00:00", db: "ZSL", id: "ZSL-2017-5430", }, { date: "2017-08-25T00:00:00", db: "ZSL", id: "ZSL-2017-5429", }, { date: "2017-08-25T00:00:00", db: "CNVD", id: "CNVD-2017-22828", }, { date: "2017-08-23T00:00:00", db: "BID", id: "100454", }, { date: "2017-09-27T00:00:00", db: "JVNDB", id: "JVNDB-2017-007644", }, { date: "2019-10-17T00:00:00", db: "CNNVD", id: "CNNVD-201706-859", }, { date: "2024-11-21T03:36:34.513000", db: "NVD", id: "CVE-2017-9644", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "local", sources: [ { db: "BID", id: "100454", }, { db: "CNNVD", id: "CNNVD-201706-859", }, ], trust: 0.9, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "ALC WebCTRL i-Vu/SiteScan Web Unreferenced Search Path Vulnerability", sources: [ { db: "IVD", id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", }, { db: "CNVD", id: "CNVD-2017-22828", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Code problem", sources: [ { db: "IVD", id: "963de9f9-6e8a-4c63-8060-67b7ca4de5ce", }, { db: "CNNVD", id: "CNNVD-201706-859", }, ], trust: 0.8, }, }
cve-2021-31682
Vulnerability from cvelistv5
Published
2021-10-22 11:24
Modified
2024-08-03 23:03
Severity ?
EPSS score ?
Summary
The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T23:03:33.651Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2021-10-29T17:06:14", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/", }, { tags: [ "x_refsource_MISC", ], url: "https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS", }, { tags: [ "x_refsource_MISC", ], url: "http://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2021-31682", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/", refsource: "MISC", url: "https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/", }, { name: "https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS", refsource: "MISC", url: "https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS", }, { name: "http://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html", refsource: "MISC", url: "http://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2021-31682", datePublished: "2021-10-22T11:24:40", dateReserved: "2021-04-23T00:00:00", dateUpdated: "2024-08-03T23:03:33.651Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Vulnerability from fkie_nvd
Published
2021-10-22 12:15
Modified
2024-11-21 06:06
Severity ?
Summary
The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS | Exploit, Third Party Advisory | |
| cve@mitre.org | https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| automatedlogic | webctrl | * |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:automatedlogic:webctrl:*:*:*:*:*:*:*:*", matchCriteriaId: "13050CD3-393C-4236-9FFA-7253E7B69491", versionEndIncluding: "6.5", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.", }, { lang: "es", value: "El portal de inicio de sesión de la aplicación web WebCTRL/WebCTRL OEM de Automated Logic contiene una vulnerabilidad que permite ataques de tipo XSS reflejados debido a que el parámetro GET de operatorlocale no a sido saneado. Este problema afecta a las versiones 6.5 y por debajo. Este problema funciona al pasar una carga útil de tipo XSS básica a un parámetro GET vulnerable que es reflejado en la salida sin sanear", }, ], id: "CVE-2021-31682", lastModified: "2024-11-21T06:06:07.587", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8.6, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: true, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 2.7, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2021-10-22T12:15:07.923", references: [ { source: "cve@mitre.org", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "http://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html", }, { source: "cve@mitre.org", tags: [ "Exploit", "Third Party Advisory", ], url: "https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", "VDB Entry", ], url: "http://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Exploit", "Third Party Advisory", ], url: "https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-79", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }