PT-2018-16957 · Microsoft+1 · Windows+1

Publicado 2018-03-20 · Atualizado 2018-04-20 · CVE-2018-5438

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Philips ISCV versions prior to 2.3.0

Description The issue is related to insufficient session expiration, allowing an attacker to reuse a previously logged-in user's session. This occurs when the ISCV application is used with an Electronic Medical Record (EMR) system in KIOSK mode for multiple users, and Windows authentication is in use. An attacker could potentially gain unauthorized access to patient health information and modify it.

Recommendations For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ISCV application when used in KIOSK mode with Windows authentication to minimize the risk of exploitation.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2018-5438

Produtos afetados

Iscv

Windows

Referências · 5

• http://securityfocus.com/bid/102847 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-025-01 · Nota
• https://usa.philips.com/healthcare/about/customer-support/product-security · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-5438 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5438 · Nota de Segurança