PT-2018-18659 · Philips · Philips E-Alert Unit

Publicado 2018-09-26 · Atualizado 2019-10-09 · CVE-2018-8846

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Philips e-Alert Unit (non-medical device) versions R2.1 and prior

Description The software does not properly neutralize user-controllable input before it is placed in output that is used as a web page, which is then served to other users.

Recommendations For versions R2.1 and prior, consider implementing input validation and sanitization to prevent malicious input from being reflected in web pages served to other users. As a temporary workaround, restrict access to the web page generation functionality until a proper fix is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-8846

Produtos afetados

Philips E-Alert Unit

Referências · 5

• http://securityfocus.com/bid/105194 · Nota
• https://osv.dev/vulnerability/CVE-2018-8846 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-8846 · Nota de Segurança
• https://usa.philips.com/healthcare/about/customer-support/product-security · Aviso do Fabricante