Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record (EMR) system, where ISCV is in KIOSK mode for multiple users and using Windows authentication. This may allow an attacker to gain unauthorized access to patient health information and potentially modify this information.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/102847 | Third Party Advisory VDB Entry |
| https://ics-cert.us-cert.gov/advisories/ICSMA-18-025-01 | Mitigation Third Party Advisory US Government Resource |
| https://www.usa.philips.com/healthcare/about/customer-support/product-security | Mitigation Vendor Advisory |
| http://www.securityfocus.com/bid/102847 | Third Party Advisory VDB Entry |
| https://ics-cert.us-cert.gov/advisories/ICSMA-18-025-01 | Mitigation Third Party Advisory US Government Resource |
| https://www.usa.philips.com/healthcare/about/customer-support/product-security | Mitigation Vendor Advisory |
Configurations
History
21 Nov 2024, 04:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/102847 - Third Party Advisory, VDB Entry | |
| References | () https://ics-cert.us-cert.gov/advisories/ICSMA-18-025-01 - Mitigation, Third Party Advisory, US Government Resource | |
| References | () https://www.usa.philips.com/healthcare/about/customer-support/product-security - Mitigation, Vendor Advisory |
Information
Published : 2018-03-20 17:29
Updated : 2024-11-21 04:08
NVD link : CVE-2018-5438
Mitre link : CVE-2018-5438
CVE.ORG link : CVE-2018-5438
JSON object : View
Products Affected
philips
- intellispace_cardiovascular
CWE
CWE-613
Insufficient Session Expiration