PT-2017-12183 · Medhost+1 · Medhost Document Management System+1

Allen Franks · Publicado 2017-07-28 · Atualizado 2017-08-15 · CVE-2017-11694

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MEDHOST Document Management System (affected versions not specified)

Description The MEDHOST Document Management System contains hard-coded credentials for Apache Solr access. An attacker with knowledge of these credentials and direct communication with Apache Solr may obtain or modify sensitive patient and financial information. The Apache Solr account name is dms, and the password is hard-coded and uniform across all installations, with no option for customers to change it. This dms account has access to all indexed patient documents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-11694

Produtos afetados

Apache Solr

Medhost Document Management System

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2017-11694 · Nota de Segurança
• http://seclists.org/fulldisclosure/2017/Jul/71 · Nota