PT-2018-18659 · Philips · Philips E-Alert Unit

Published 2018-09-26 · Updated 2019-10-09 · CVE-2018-8846

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Philips e-Alert Unit (non-medical device) versions R2.1 and prior

Description The software does not properly neutralize user-controllable input before it is placed in output that is used as a web page, which is then served to other users.

Recommendations For versions R2.1 and prior, consider implementing input validation and sanitization to prevent malicious input from being reflected in web pages served to other users. As a temporary workaround, restrict access to the web page generation functionality until a proper fix is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-8846

Affected Products

Philips E-Alert Unit

References · 5

• https://osv.dev/vulnerability/CVE-2018-8846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8846 · Security Note
• https://usa.philips.com/healthcare/about/customer-support/product-security · Vendor Advisory
• http://securityfocus.com/bid/105194 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-242-01 · Note