CVE-2010-5308

{"id": "CVE-2010-5308", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": true, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-08-04T14:59:11.503", "references": [{"url": "http://apps.gehealthcare.com/servlet/ClientServlet/MR360+operator+manual+paper.pdf?REQ=RAA&DIRECTION=5339461-1EN&FILENAME=MR360%2Boperator%2Bmanual%2Bpaper.pdf&FILEREV=4&DOCREV_ORG=4", "source": "cve@mitre.org"}, {"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/", "source": "cve@mitre.org"}, {"url": "https://twitter.com/digitalbond/status/619250429751222277", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "GE Healthcare Optima MR360 does not require authentication for the HIPAA emergency login procedure, which allows physically proximate users to gain access via an arbitrary username in the Emergency Login screen. NOTE: this might not qualify for inclusion in CVE if unauthenticated emergency access is part of the intended security policy of the product, can be controlled by the system administrator, and is not enabled by default."}, {"lang": "es", "value": "Vulnerabilidad en GE Healthcare Optima MR360, no requiere autenticaci\u00f3n para el procedimiento de acceso de emergencia de HIPAA, lo que permite a usuarios f\u00edsicamente pr\u00f3ximos obtener acceso a trav\u00e9s de un nombre de usuario arbitrario en la pantalla de Emergency Login. NOTA: esto podr\u00eda no calificarse para su incorporaci\u00f3n en CVE si el acceso de emergencia no autenticado es parte de la pol\u00edtica de seguridad prevista para el producto, puede ser controlado por el administrador del sistema y no est\u00e1 habilitado por defecto."}], "lastModified": "2015-08-05T11:31:44.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:gehealthcare:optima_mr360_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6056690-0318-4110-BF67-2F6B6455A1EA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}