CVE-2017-9656

{"id": "CVE-2017-9656", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2018-04-24T15:29:00.867", "references": [{"url": "http://www.philips.com/productsecurity", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.securityfocus.com/bid/100471", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-229-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database account with privileges that can affect confidentiality, integrity, and availability of the database. For an attacker to exploit this vulnerability, elevated privileges are first required for an attacker to access the web application backend system files that contain the hard-coded credentials. Successful exploitation may allow a remote attacker to gain access to the database of the DWP application, which contains PHI. CVSS v3 base score: 9.1, CVSS vector string: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H."}, {"lang": "es", "value": "La base de datos del backend de la aplicaci\u00f3n Philips DoseWise Portal, en sus versiones 1.1.7.333 y 2.1.1.3069, emplea credenciales embebidas para una cuenta de la base de datos con privilegios que puede afectar a la confidencialidad, integridad y disponibilidad de la base de datos. Para que un atacante explote esta vulnerabilidad, primero necesita privilegios elevados para poder acceder a los archivos del sistema del backend de la aplicaci\u00f3n web que contienen las credenciales embebidas. Si se explota esta vulnerabilidad con \u00e9xito, un atacante remoto podr\u00eda obtener acceso a la base de datos de la aplicaci\u00f3n DWP, que contiene PHI. Puntuaci\u00f3n base de CVSS v3: 9.1, cadena de vector CVSS: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H."}], "lastModified": "2019-10-09T23:30:46.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:philips:dosewise:1.1.7.333:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80593A69-82A9-47D2-A64A-248018A0C59D"}, {"criteria": "cpe:2.3:a:philips:dosewise:2.1.1.3069:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE12F34E-51D6-4045-888A-5D702FE85B1F"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}