PT-2021-21264 · Cerner · Cerner Mobile Care

Published 2021-08-24 · Updated 2021-08-31 · CVE-2021-36385

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cerner Mobile Care version 5.0.0

Description A SQL Injection issue allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fullwidth Apostrophe (aka U+FF07) in the User ID field of the "default.aspx" page. This can lead to the execution of arbitrary system commands through the use of xp cmdshell.

Recommendations For Cerner Mobile Care version 5.0.0, consider restricting access to the default.aspx page or disabling the use of the User ID field until a patch is available. As a temporary workaround, avoid using the User ID field with special characters like the Fullwidth Apostrophe (U+FF07) to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-36385

Affected Products

Cerner Mobile Care

References · 7

• https://osv.dev/vulnerability/CVE-2021-36385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36385 · Security Note
• https://cerner.com/solutions/mobility · Vendor Advisory
• https://t.me/cvenotify/20415 · Telegram Post
• https://blacklanternsecurity.com/blog · Note
• https://blacklanternsecurity.com/2021-08-13-Cerner-MobileCare-CVE · Note
• https://t.me/cibsecurity/27761 · Telegram Post