Invensys Wonderware Information Server CVE-2013-0686 Information Disclosure Vulnerability

Bugtraq ID:	59708
Class:	Design Error
CVE:	CVE-2013-0686
Remote:	No
Local:	Yes
Published:	May 07 2013 12:00AM
Updated:	May 07 2013 12:00AM
Credit:	Timur Yunusov, Alexey Osipov, and Ilya Karpov of the Positive Technologies Research Team
Vulnerable:	Invensys Wonderware Information Server 4.5 Portal Invensys Wonderware Information Server 4.0 SP1
Not Vulnerable:

Invensys Wonderware Information Server CVE-2013-0686 Information Disclosure Vulnerability

Invensys Wonderware Information Server is prone to a local information-disclosure vulnerability.

A local attacker can exploit this issue to obtain sensitive information; other attacks may also be possible.

The following versions are vulnerable:

Wonderware Information Server 4.0 SP1
Wonderware Information Server 4.5 Portal
Wonderware Information Server 5.0 Portal

Invensys Wonderware Information Server CVE-2013-0686 Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Invensys Wonderware Information Server CVE-2013-0686 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.