PT-2022-9382 · Fresenius Kabi · Agilia Link+

Dr. Oliver Matula + 3 · Published 2022-01-21 · Updated 2022-01-28 · CVE-2021-23233

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fresenius Kabi Agilia Link+ versions 3.0 and prior

Description The issue allows access to sensitive endpoints without requiring authentication information, such as a session cookie. This enables an attacker to send requests to these endpoints as an unauthenticated user, potentially performing critical actions or modifying critical configuration parameters.

Recommendations For Fresenius Kabi Agilia Link+ versions 3.0 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Using Hardcoded Credentials

Weakness Enumeration

CWE-284

CWE-798

Related Identifiers

CVE-2021-23233

Affected Products

Agilia Link+

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-23233 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23233 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsma-21-355-01 · Note