PT-2013-6196 · Osehra · Osehra Vista

Publicado 2013-12-04 · Atualizado 2014-02-25 · CVE-2013-6945

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OSEHRA VistA versions prior to September 30, 2013

Description The issue allows attackers to bypass authentication and authorization, enabling them to perform actions restricted to doctors and access or modify patient records. This is due to a logic flaw, although the specific vectors related to this flaw are not specified.

Recommendations For OSEHRA VistA versions prior to September 30, 2013, update to a version released after September 30, 2013, to resolve the issue. As a temporary workaround, consider restricting access to sensitive patient records and doctor-only actions until the update can be applied.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-6945

Produtos afetados

Osehra Vista

Referências · 4

• http://osehra.org/blog/m2m-broker-security-patch · Correção
• http://darkreading.com/vulnerability/anatomy-of-an-electronic-health-record-e/240164441 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6945 · Nota de Segurança
• http://osehra.org/blog/vista-patch-available-osehra · Nota