PT-2018-12738 · Philips · Philips E-Alert Unit

Published 2018-09-26 · Updated 2019-10-09 · CVE-2018-14803

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Philips e-Alert Unit (non-medical device) versions R2.1 and prior

Description The Philips e-Alert contains a banner disclosure issue that could allow attackers to obtain extraneous product information, such as the operating system and software components, via the HTTP response header. This information, normally not available to attackers, might be useful in an attack.

Recommendations For versions R2.1 and prior, consider restricting access to the HTTP response header to minimize the risk of exploitation. As a temporary workaround, limiting the information disclosed in the HTTP response header could help mitigate the issue until a fix is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-14803

Affected Products

Philips E-Alert Unit

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-14803 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14803 · Vendor Advisory
• https://usa.philips.com/healthcare/about/customer-support/product-security · Vendor Advisory
• http://securityfocus.com/bid/105194 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01 · Note