PT-2017-12183 · Medhost+1 · Medhost Document Management System+1

Allen Franks · Published 2017-07-28 · Updated 2017-08-15 · CVE-2017-11694

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MEDHOST Document Management System (affected versions not specified)

Description The MEDHOST Document Management System contains hard-coded credentials for Apache Solr access. An attacker with knowledge of these credentials and direct communication with Apache Solr may obtain or modify sensitive patient and financial information. The Apache Solr account name is dms, and the password is hard-coded and uniform across all installations, with no option for customers to change it. This dms account has access to all indexed patient documents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-11694

Affected Products

Apache Solr

Medhost Document Management System

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2017-11694 · Security Note
• http://seclists.org/fulldisclosure/2017/Jul/71 · Note