PT-2022-9376 · Fresenius Kabi · Fresenius Kabi Vigilant Mastermed

Dr. Oliver Matula + 3 · Published 2022-01-21 · Updated 2022-08-30 · CVE-2021-23207

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fresenius Kabi Vigilant MasterMed version 2.0.1.3

Description An attacker with physical access to the host can extract secrets from the registry and create valid JWT tokens for the application, allowing them to impersonate arbitrary users. This could also enable the manipulation of RabbitMQ queues and messages by impersonating users.

Recommendations For Fresenius Kabi Vigilant MasterMed version 2.0.1.3, consider restricting physical access to the host to minimize the risk of exploitation. As a temporary workaround, restrict access to the registry and limit the ability to create JWT tokens. Additionally, monitor RabbitMQ queues and messages for suspicious activity. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2021-23207

Affected Products

Fresenius Kabi Vigilant Mastermed

References · 6

• https://osv.dev/vulnerability/CVE-2021-23207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23207 · Security Note
• https://t.me/cvenotify/25946 · Telegram Post
• https://t.me/cvenotify/35414 · Telegram Post
• https://t.me/cibsecurity/36066 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsma-21-355-01 · Note