Skip to content
CVE Tracker
Back

CVE-2014-0772

Advantech WebAccess File and Directory Information Exposure

Medium5.0EPSS 1.4%
Published
Updated
Reserved
Assigned by
icscert

Description

The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout. This method takes a URL as a parameter and returns its contents to the caller in JavaScript. The URLs are accessed in the security context of the current browser session. The control does not perform any URL validation and allows file:// URLs that access the local disk. The method can be used to open a URL (including file URLs) and read the URLs through JavaScript. This method could also be used to reach any arbitrary URL to which the browser has access.

Scores

CVSS scores of CVE-2014-0772, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)2.0Medium5.0AV:N/AC:L/Au:N/C:P/I:N/A:N
NVDNVD · Modified2.0Medium5.0AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS (exploitation in 30 days)
1.4% · top 27% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

Affected products

  • Advantech · WebAccess

    • affected ≤ 7.1
    • unaffected 7.2

What to do

Solution: Advantech has created a new version (Version 7.2) that mitigates each of the vulnerabilities described above. Users may download this version from the following location at their web site:  http://webaccess.advantech.com/downloads.php?item=software For additional information about WebAccess, please visit the following Advantech web site:  http://webaccess.advantech.com/

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .