PT-2022-11828 · Fresenius Kabi · Fresenius Kabi Vigilant Software Suite

Dr. Oliver Matula + 3 · Published 2022-01-21 · Updated 2022-08-09 · CVE-2021-43355

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3

Description The issue allows user input to be validated on the client side without proper authentication by the server. This is problematic because the server should not rely solely on the correctness of the data sent by the client, as users may not support or block JavaScript, or could intentionally bypass the client-side checks. An attacker with knowledge of the service user could exploit this by circumventing the client-side control, potentially allowing them to login with service privileges.

Recommendations For Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3, consider implementing server-side validation to authenticate user input properly, ensuring that the server does not rely on client-side checks alone. As a temporary workaround, restrict access to service user accounts to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-603

Related Identifiers

CVE-2021-43355

Affected Products

Fresenius Kabi Vigilant Software Suite

References · 4

• https://osv.dev/vulnerability/CVE-2021-43355 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43355 · Security Note
• https://t.me/cvenotify/25947 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsma-21-355-01 · Note