CVE-2024-6795

In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database. An attacker could have submitted a crafted payload to Connex portal that could have resulted in modification and disclosure of database content and/or perform administrative operations including shutting down the database.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-249-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:baxter:connex_health_portal:*:*:*:*:*:*:*:*

History

20 Sep 2024, 14:53

Type	Values Removed	Values Added
CPE		cpe:2.3:a:baxter:connex_health_portal::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~10.0~~	v2 : unknown v3 : 9.8
References	~~() https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-249-01 -~~	() https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-249-01 - Third Party Advisory, US Government Resource
First Time		Baxter Baxter connex Health Portal

10 Sep 2024, 12:09

Type	Values Removed	Values Added
Summary		(es) En el portal de salud Connex publicado antes del 30/8/2024, se encontraron vulnerabilidades de inyección SQL que podrían haber permitido que un atacante no autenticado obtuviera acceso no autorizado a la base de datos del portal Connex. Un atacante podría haber enviado un payload manipulado al portal Connex que podría haber dado lugar a la modificación y divulgación del contenido de la base de datos y/o a la realización de operaciones administrativas, incluido el cierre de la base de datos.

09 Sep 2024, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-09 20:15

Updated : 2024-09-20 14:53

NVD link : CVE-2024-6795

Mitre link : CVE-2024-6795

CVE.ORG link : CVE-2024-6795

JSON object : View

Products Affected

baxter

connex_health_portal

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-6795", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "productsecurity@baxter.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "published": "2024-09-09T20:15:05.253", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-249-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "productsecurity@baxter.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Secondary", "source": "productsecurity@baxter.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database.\u00a0\n\nAn attacker could have submitted a crafted payload to Connex portal that could have resulted in modification and disclosure of database content \n\nand/or perform administrative operations including shutting down the database."}, {"lang": "es", "value": "En el portal de salud Connex publicado antes del 30/8/2024, se encontraron vulnerabilidades de inyecci\u00f3n SQL que podr\u00edan haber permitido que un atacante no autenticado obtuviera acceso no autorizado a la base de datos del portal Connex. Un atacante podr\u00eda haber enviado un payload manipulado al portal Connex que podr\u00eda haber dado lugar a la modificaci\u00f3n y divulgaci\u00f3n del contenido de la base de datos y/o a la realizaci\u00f3n de operaciones administrativas, incluido el cierre de la base de datos."}], "lastModified": "2024-09-20T14:53:15.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:baxter:connex_health_portal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21E3F634-BFB7-4605-91ED-E03F8EA2E7C4", "versionEndExcluding": "2024-08-30"}], "operator": "OR"}]}], "sourceIdentifier": "productsecurity@baxter.com"}