PT-2013-6196 · Osehra · Osehra Vista

Published 2013-12-04 · Updated 2014-02-25 · CVE-2013-6945

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OSEHRA VistA versions prior to September 30, 2013

Description The issue allows attackers to bypass authentication and authorization, enabling them to perform actions restricted to doctors and access or modify patient records. This is due to a logic flaw, although the specific vectors related to this flaw are not specified.

Recommendations For OSEHRA VistA versions prior to September 30, 2013, update to a version released after September 30, 2013, to resolve the issue. As a temporary workaround, consider restricting access to sensitive patient records and doctor-only actions until the update can be applied.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-6945

Affected Products

Osehra Vista

References · 4

• http://osehra.org/blog/m2m-broker-security-patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-6945 · Security Note
• http://darkreading.com/vulnerability/anatomy-of-an-electronic-health-record-e/240164441 · Note
• http://osehra.org/blog/vista-patch-available-osehra · Note