CVE-2021-32966

Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information when configured to use LDAP via TLS and where the domain controller returns LDAP referrals, which may allow an attacker to remotely read LDAP system credentials.

CVSS v3 3.7 LOW
CVSS v2.0 4.3 MEDIUM

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsma-21-175-01	Mitigation Third Party Advisory US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsma-21-175-01	Mitigation Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:philips:interoperability_solution_xds::::::::
	cpe:2.3:a:philips:interoperability_solution_xds::::::::

History

21 Nov 2024, 06:08

Type	Values Removed	Values Added
References	~~() https://www.cisa.gov/uscert/ics/advisories/icsma-21-175-01 - Mitigation, Third Party Advisory, US Government Resource~~	() https://www.cisa.gov/uscert/ics/advisories/icsma-21-175-01 - Mitigation, Third Party Advisory, US Government Resource
CVSS	v2 : ~~4.3~~ v3 : ~~7.5~~	v2 : 4.3 v3 : 3.7

Information

Published : 2022-05-25 14:15

Updated : 2024-11-21 06:08

NVD link : CVE-2021-32966

Mitre link : CVE-2021-32966

CVE.ORG link : CVE-2021-32966

JSON object : View

Products Affected

philips

interoperability_solution_xds

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2021-32966", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-05-25T14:15:08.380", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-175-01", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-175-01", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information when configured to use LDAP via TLS and where the domain controller returns LDAP referrals, which may allow an attacker to remotely read LDAP system credentials."}, {"lang": "es", "value": "Philips Interoperability Solution XDS versiones 2.5 a 3.11 y 2018-1 a 2021-1, son vulnerables a una transmisi\u00f3n de texto sin cifrar de informaci\u00f3n confidencial cuando est\u00e1n configuradas para usar LDAP por medio de TLS y cuando el controlador de dominio devuelve referencias LDAP, lo que puede permitir a un atacante leer remotamente las credenciales del sistema LDAP"}], "lastModified": "2024-11-21T06:08:01.373", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:philips:interoperability_solution_xds:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42655F70-9885-4203-A409-57A0D3623D60", "versionEndIncluding": "3.11", "versionStartIncluding": "2.5"}, {"criteria": "cpe:2.3:a:philips:interoperability_solution_xds:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10EB46E4-2544-4947-B5E3-01842DB10DBC", "versionEndIncluding": "2021-1", "versionStartIncluding": "2018-1"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}