CVE-2018-10591
Last modified
CVE-2018-10591 is a vulnerability of currently unknown severity. In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an origin validation error vulnerability has been identified, which may allow an attacker can create a malicious web site, steal session cookies, and access data of authenticated users.. EPSS estimates a 0.65% chance of exploitation in the next 30 days.
Description
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an origin validation error vulnerability has been identified, which may allow an attacker can create a malicious web site, steal session cookies, and access data of authenticated users.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Advantech | Webaccess | <= 8.2_20170817 |
| Advantech | Webaccess | <= 8.3.0 |
| Advantech | Webaccess Dashboard | <= 2.0.15 |
| Advantech | Webaccess Scada | < 8.3.1 |
| Advantech | Webaccess\/Nms | <= 2.0.3 |
References
- http://www.securityfocus.com/bid/104190Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/104190Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-10591?
How severe is CVE-2018-10591?
How do I fix CVE-2018-10591?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-10585Pexip Infinity before 18 allows remote Denial of Service (XM…7.5
- CVE-2018-10586NetGain Enterprise Manager (EM) is affected by multiple Stor…
- CVE-2018-10587NetGain Enterprise Manager (EM) is affected by OS Command In…
- CVE-2018-10589In Advantech WebAccess versions V8.2_20170817 and prior, Web…
- CVE-2018-1059The DPDK vhost-user interface does not check to verify that …
- CVE-2018-10590In Advantech WebAccess versions V8.2_20170817 and prior, Web…
- CVE-2018-10592Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 co…
- CVE-2018-10593A vulnerability in DB Manager version 3.0.1.0 and previous a…
- CVE-2018-10594Delta Industrial Automation COMMGR from Delta Electronics ve…
- CVE-2018-10595A vulnerability in ReadA version 1.1.0.2 and previous allows…
- CVE-2018-10596Medtronic 2090 CareLink Programmer uses a virtual private …7.1
- CVE-2018-10597IntelliVue Patient Monitors MP Series (including MP2/X2/MP30…8.3
Are you affected by CVE-2018-10591?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST