CVE-2018-5438 - Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability

CVE-2018-5438

Summary

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record (EMR) system, where ISCV is in KIOSK mode for multiple users and using Windows authentication. This may allow an attacker to gain unauthorized access to patient health information and potentially modify this information.

References

Vulnerable Configurations

cpe:2.3:a:philips:intellispace_cardiovascular:*:*:*:*:*:*:*:*
cpe:2.3:a:philips:intellispace_cardiovascular:*:*:*:*:*:*:*:*

CVSS

Base:	3.3 (as of 20-04-2018 - 15:02)
Impact:
Exploitability:

CWE

CWE-613

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:L/AC:M/Au:N/C:P/I:P/A:N

refmap via4

bid	102847
confirm	https://www.usa.philips.com/healthcare/about/customer-support/product-security
misc	https://ics-cert.us-cert.gov/advisories/ICSMA-18-025-01

Last major update

20-04-2018 - 15:02

Published

20-03-2018 - 17:29

Last modified

20-04-2018 - 15:02