CVE-2014-0772
Severity CVSS v4.0:
Pending analysis
Type:
CWE-538
Insertion of Sensitive Information into Externally-Accessible File or Directory
Publication date:
12/04/2014
Last modified:
19/09/2025
Description
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named <br />
OpenUrlToBufferTimeout. This method takes a URL as a parameter and <br />
returns its contents to the caller in JavaScript. The URLs are accessed <br />
in the security context of the current browser session. The control does<br />
not perform any URL validation and allows file:// URLs that access the <br />
local disk.<br />
<br />
<br />
The method can be used to open a URL (including file URLs) and read <br />
the URLs through JavaScript. This method could also be used to reach any<br />
arbitrary URL to which the browser has access.
Impact
Base Score 2.0
5.00
Severity 2.0
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:advantech:advantech_webaccess:*:*:*:*:*:*:*:* | 7.1 (including) | |
| cpe:2.3:a:advantech:advantech_webaccess:5.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:advantech:advantech_webaccess:6.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:advantech:advantech_webaccess:7.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page