ID CVE-2020-16200
Summary Philips Clinical Collaboration Platform, Versions 12.2.1 and prior. The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an attacker to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
References
Vulnerable Configurations
  • cpe:2.3:a:philips:clinical_collaboration_platform:12.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:philips:clinical_collaboration_platform:12.2.1:*:*:*:*:*:*:*
CVSS
Base: 3.3 (as of 25-09-2020 - 19:10)
Impact:
Exploitability:
CWE CWE-757
CAPEC
  • Drop Encryption Level
    An attacker forces the encryption level to be lowered, thus enabling a successful attack against the encrypted data.
  • Weakening of Cellular Encryption
    An attacker, with control of a Cellular Rogue Base Station or through cooperation with a Malicious Mobile Network Operator can force the mobile device (e.g., the retransmission device) to use no encryption (A5/0 mode) or to use easily breakable encryption (A5/1 or A5/2 mode).
  • Client-Server Protocol Manipulation
    An adversary takes advantage of weaknesses in the protocol by which a client and server are communicating to perform unexpected actions. Communication protocols are necessary to transfer messages between client and server applications. Moreover, different protocols may be used for different types of interactions. For example, an authentication protocol might be used to establish the identities of the server and client while a separate messaging protocol might be used to exchange data. If there is a weakness in a protocol used by the client and server, an attacker might take advantage of this to perform various types of attacks. For example, if the attacker is able to manipulate an authentication protocol, the attacker may be able spoof other clients or servers. If the attacker is able to manipulate a messaging protocol, the may be able to read sensitive information or modify message contents. This attack is often made easier by the fact that many clients and servers support multiple protocols to perform similar roles. For example, a server might support several different authentication protocols in order to support a wide range of clients, including legacy clients. Some of the older protocols may have vulnerabilities that allow an attacker to manipulate client-server interactions.
Access
VectorComplexityAuthentication
ADJACENT_NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:A/AC:L/Au:N/C:N/I:N/A:P
refmap via4
misc https://us-cert.cisa.gov/ics/advisories/icsma-20-261-01
Last major update 25-09-2020 - 19:10
Published 18-09-2020 - 18:15
Last modified 25-09-2020 - 19:10
Back to Top