PT-2018-12721 · Philips · Intellispace Cardiovascular+1

Publicado 2018-08-22 · Atualizado 2022-04-22 · CVE-2018-14787

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IntelliSpace Cardiovascular versions 2.x and earlier Xcelera versions 4.1 and earlier

Description An issue exists where an attacker with escalated privileges could access folders containing executables where authenticated users have write permissions, allowing the execution of arbitrary code with local administrative permissions.

Recommendations For IntelliSpace Cardiovascular versions 2.x and earlier, update to a version later than 2.x to resolve the issue. For Xcelera versions 4.1 and earlier, update to a version later than 4.1 to resolve the issue. As a temporary workaround, consider restricting write permissions for authenticated users in the affected folders to minimize the risk of exploitation.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2018-14787

Produtos afetados

Intellispace Cardiovascular

Xcelera

Referências · 5

• https://t.me/cvenotify/26526 · Publicação no Telegram
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-226-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14787 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-14787 · Aviso do Fabricante
• https://usa.philips.com/healthcare/about/customer-support/product-security · Aviso do Fabricante