CVE-2020-36548

A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation leads to improper authentication and elevated access possibilities. It is possible to launch the attack on the local host.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://vuldb.com/?id.129834
https://www.scip.ch/?news.20200701

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:ge:voluson_s8_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ge:voluson_s8:-:*:*:*:*:*:*:*

History

07 Nov 2023, 03:22

Type	Values Removed	Values Added
References	~~(N/A) https://vuldb.com/?id.129834 - Third Party Advisory~~	() https://vuldb.com/?id.129834 -
References	~~(N/A) https://www.scip.ch/?news.20200701 - Third Party Advisory~~	() https://www.scip.ch/?news.20200701 -

Information

Published : 2022-06-17 13:15

Updated : 2024-02-28 19:09

NVD link : CVE-2020-36548

Mitre link : CVE-2020-36548

CVE.ORG link : CVE-2020-36548

JSON object : View

Products Affected

ge

voluson_s8_firmware
voluson_s8

CWE

CWE-287

Improper Authentication

{"id": "CVE-2020-36548", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.5}]}, "published": "2022-06-17T13:15:11.993", "references": [{"url": "https://vuldb.com/?id.129834", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.scip.ch/?news.20200701", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation leads to improper authentication and elevated access possibilities. It is possible to launch the attack on the local host."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad clasificada como problem\u00e1tica en GE Voluson S8. El archivo afectado es /uscgi-bin/users.cgi del navegador de servicios. La manipulaci\u00f3n conlleva a una autenticaci\u00f3n inapropiada y posibilidades de acceso elevadas. Es posible lanzar el ataque en el host local"}], "lastModified": "2023-11-07T03:22:16.733", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ge:voluson_s8_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4BEFE93-8264-43DC-AC82-F8EFF6800AF3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ge:voluson_s8:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7E5D3069-7828-4860-B072-4180AF0D4B2C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}