PT-2017-16838 · Becton · Kla Journal Service+2

Published 2017-06-30 · Updated 2019-10-09 · CVE-2017-6022

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Becton, Dickinson and Company (BD) PerformA versions 2.0.14.0 and prior Becton, Dickinson and Company (BD) KLA Journal Service versions 1.0.51 and prior

Description A hard-coded password issue was discovered, which could be leveraged to compromise the confidentiality of limited PHI/PII information stored in the BD Kiestra Database. The issue arises because the software uses hard-coded passwords to access the database.

Recommendations For Becton, Dickinson and Company (BD) PerformA versions 2.0.14.0 and prior, consider changing the hard-coded password to a secure, user-defined password to prevent unauthorized access. For Becton, Dickinson and Company (BD) KLA Journal Service versions 1.0.51 and prior, consider changing the hard-coded password to a secure, user-defined password to prevent unauthorized access. As a temporary workaround, consider restricting access to the BD Kiestra Database until a secure password can be implemented.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-259

Related Identifiers

CVE-2017-6022

Affected Products

Bd Kiestra Database

Kla Journal Service

Performa

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-6022 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6022 · Vendor Advisory
• http://securityfocus.com/bid/97057 · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-01 · Note