PT-2018-8517 · Philips · Dosewise Portal

Publicado 2018-04-24 · Atualizado 2019-10-09 · CVE-2017-9656

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069

Description The Philips DoseWise Portal application has a security issue where the backend database uses hard-coded credentials for a database account. This account has privileges that can impact the confidentiality, integrity, and availability of the database. To exploit this, an attacker first needs elevated privileges to access the web application's backend system files, which contain the hard-coded credentials. If successfully exploited, a remote attacker may gain access to the database, which contains protected health information.

Recommendations For version 1.1.7.333, update to a version that does not use hard-coded credentials to prevent potential exploitation. For version 2.1.1.3069, update to a version that does not use hard-coded credentials to prevent potential exploitation. As a temporary workaround, consider restricting access to the backend system files to minimize the risk of exploitation.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-9656

Produtos afetados

Dosewise Portal

Referências · 5

• https://ics-cert.us-cert.gov/advisories/ICSMA-17-229-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9656 · Nota de Segurança
• http://securityfocus.com/bid/100471 · Nota
• http://philips.com/productsecurity · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-9656 · Aviso do Fabricante