PT-2022-10166 · Philips · Philips Interoperability Solution Xds

Published 2022-05-25 · Updated 2022-06-08 · CVE-2021-32966

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Philips Interoperability Solution XDS versions 2.5 through 3.11 Philips Interoperability Solution XDS versions 2018-1 through 2021-1

Description The issue concerns the clear text transmission of sensitive information when the solution is configured to use LDAP via TLS and the domain controller returns LDAP referrals. This may allow an attacker to remotely read LDAP system credentials.

Recommendations For Philips Interoperability Solution XDS versions 2.5 through 3.11, consider reconfiguring the LDAP settings to prevent clear text transmission of sensitive information. For Philips Interoperability Solution XDS versions 2018-1 through 2021-1, consider reconfiguring the LDAP settings to prevent clear text transmission of sensitive information. As a temporary workaround, consider disabling the use of LDAP referrals until a patch is available.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2021-32966

Affected Products

Philips Interoperability Solution Xds

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-32966 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32966 · Vendor Advisory
• https://t.me/cibsecurity/43339 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsma-21-175-01 · Note
• https://t.me/cvenotify/30703 · Telegram Post