CVE-2010-5308

GE Healthcare Optima MR360 does not require authentication for the HIPAA emergency login procedure, which allows physically proximate users to gain access via an arbitrary username in the Emergency Login screen. NOTE: this might not qualify for inclusion in CVE if unauthenticated emergency access is part of the intended security policy of the product, can be controlled by the system administrator, and is not enabled by default.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://apps.gehealthcare.com/servlet/ClientServlet/MR360+operator+manual+paper.pdf?REQ=RAA&DIRECTION=5339461-1EN&FILENAME=MR360%2Boperator%2Bmanual%2Bpaper.pdf&FILEREV=4&DOCREV_ORG=4
http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/
https://twitter.com/digitalbond/status/619250429751222277

Configurations

Configuration 1 (hide)

cpe:2.3:o:gehealthcare:optima_mr360_firmware:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-08-04 14:59

Updated : 2024-02-28 15:21

NVD link : CVE-2010-5308

Mitre link : CVE-2010-5308

CVE.ORG link : CVE-2010-5308

JSON object : View

Products Affected

gehealthcare

optima_mr360_firmware

CWE

CWE-255

Credentials Management Errors

{"id": "CVE-2010-5308", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": true, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-08-04T14:59:11.503", "references": [{"url": "http://apps.gehealthcare.com/servlet/ClientServlet/MR360+operator+manual+paper.pdf?REQ=RAA&DIRECTION=5339461-1EN&FILENAME=MR360%2Boperator%2Bmanual%2Bpaper.pdf&FILEREV=4&DOCREV_ORG=4", "source": "cve@mitre.org"}, {"url": "http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/", "source": "cve@mitre.org"}, {"url": "https://twitter.com/digitalbond/status/619250429751222277", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "GE Healthcare Optima MR360 does not require authentication for the HIPAA emergency login procedure, which allows physically proximate users to gain access via an arbitrary username in the Emergency Login screen. NOTE: this might not qualify for inclusion in CVE if unauthenticated emergency access is part of the intended security policy of the product, can be controlled by the system administrator, and is not enabled by default."}, {"lang": "es", "value": "Vulnerabilidad en GE Healthcare Optima MR360, no requiere autenticaci\u00f3n para el procedimiento de acceso de emergencia de HIPAA, lo que permite a usuarios f\u00edsicamente pr\u00f3ximos obtener acceso a trav\u00e9s de un nombre de usuario arbitrario en la pantalla de Emergency Login. NOTA: esto podr\u00eda no calificarse para su incorporaci\u00f3n en CVE si el acceso de emergencia no autenticado es parte de la pol\u00edtica de seguridad prevista para el producto, puede ser controlado por el administrador del sistema y no est\u00e1 habilitado por defecto."}], "lastModified": "2015-08-05T11:31:44.633", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:gehealthcare:optima_mr360_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6056690-0318-4110-BF67-2F6B6455A1EA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}