Search criteria

3 vulnerabilities found for Vue RIS by Carestream

VAR-201810-0478

Vulnerability from variot - Updated: 2023-12-18 13:13

Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack. Carestream Vue RIS Contains an information disclosure vulnerability.Information may be obtained. An attacker could exploit this vulnerability to obtain technical information

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201810-0478",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "vue ris",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "carestream",
        "version": "11.2"
      },
      {
        "model": "vue ris",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "carestream",
        "version": "11.2"
      },
      {
        "model": "vue ris",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "carestream",
        "version": "ris client builds 11.2"
      },
      {
        "model": "vue ris",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "carestream",
        "version": "\u003c=11.2"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "carestream vue ris",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "BID",
        "id": "105713"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:carestream:carestream_vue_ris:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "11.2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Dan Regalado of Zingbox",
    "sources": [
      {
        "db": "BID",
        "id": "105713"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-17891",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2018-17891",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 4.9,
            "id": "CNVD-2018-21171",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "LOW",
            "trust": 0.6,
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 4.9,
            "id": "7d856950-463f-11e9-bb98-000c29342cb1",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "LOW",
            "trust": 0.2,
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
            "version": "2.9 [IVD]"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.2,
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 3.7,
            "baseSeverity": "Low",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2018-17891",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2018-17891",
            "trust": 1.8,
            "value": "LOW"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2018-21171",
            "trust": 0.6,
            "value": "LOW"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201810-156",
            "trust": 0.6,
            "value": "LOW"
          },
          {
            "author": "IVD",
            "id": "7d856950-463f-11e9-bb98-000c29342cb1",
            "trust": 0.2,
            "value": "LOW"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack. Carestream Vue RIS Contains an information disclosure vulnerability.Information may be obtained. An attacker could exploit this vulnerability to obtain technical information",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "BID",
        "id": "105713"
      },
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      }
    ],
    "trust": 2.61
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-17891",
        "trust": 3.5
      },
      {
        "db": "ICS CERT",
        "id": "ICSMA-18-277-01",
        "trust": 2.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568",
        "trust": 0.8
      },
      {
        "db": "BID",
        "id": "105713",
        "trust": 0.3
      },
      {
        "db": "IVD",
        "id": "7D856950-463F-11E9-BB98-000C29342CB1",
        "trust": 0.2
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "BID",
        "id": "105713"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "id": "VAR-201810-0478",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      }
    ],
    "trust": 1.4
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      }
    ]
  },
  "last_update_date": "2023-12-18T13:13:39.900000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CARESTREAM Vue RIS",
        "trust": 0.8,
        "url": "https://www.carestream.com/en/us/medical/products/vue-healthit/radiology/carestream-vue-ris"
      },
      {
        "title": "Patch for Carestream Vue RIS Information Disclosure Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/142569"
      },
      {
        "title": "Carestream Vue RIS Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=86164"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-200",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.7,
        "url": "https://ics-cert.us-cert.gov/advisories/icsma-18-277-01"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-17891"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17891"
      },
      {
        "trust": 0.3,
        "url": "https://www.carestream.com"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "BID",
        "id": "105713"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "BID",
        "id": "105713"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-10-18T00:00:00",
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "date": "2018-10-17T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "date": "2018-10-04T00:00:00",
        "db": "BID",
        "id": "105713"
      },
      {
        "date": "2018-12-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "date": "2018-10-04T21:29:01.983000",
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "date": "2018-10-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-11-01T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "date": "2018-10-04T00:00:00",
        "db": "BID",
        "id": "105713"
      },
      {
        "date": "2018-12-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "date": "2019-10-09T23:37:00.050000",
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Carestream Vue RIS Information Disclosure Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ],
    "trust": 1.4
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "information disclosure",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ],
    "trust": 0.6
  }
}

CVE-2018-17891 (GCVE-0-2018-17891)

Vulnerability from cvelistv5 – Published: 2018-10-04 21:00 – Updated: 2024-09-17 02:32
VLAI?
Summary
Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack.
Severity ?
No CVSS data available.
CWE
  • CWE-209 - INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209
Assigner
References
Impacted products
Vendor Product Version
Carestream Vue RIS Affected: RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:01:14.459Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Vue RIS",
          "vendor": "Carestream",
          "versions": [
            {
              "status": "affected",
              "version": "RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5"
            }
          ]
        }
      ],
      "datePublic": "2018-10-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-04T20:57:01",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2018-10-04T00:00:00",
          "ID": "CVE-2018-17891",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Vue RIS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Carestream"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-17891",
    "datePublished": "2018-10-04T21:00:00Z",
    "dateReserved": "2018-10-02T00:00:00",
    "dateUpdated": "2024-09-17T02:32:31.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-17891 (GCVE-0-2018-17891)

Vulnerability from nvd – Published: 2018-10-04 21:00 – Updated: 2024-09-17 02:32
VLAI?
Summary
Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack.
Severity ?
No CVSS data available.
CWE
  • CWE-209 - INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209
Assigner
References
Impacted products
Vendor Product Version
Carestream Vue RIS Affected: RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:01:14.459Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Vue RIS",
          "vendor": "Carestream",
          "versions": [
            {
              "status": "affected",
              "version": "RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5"
            }
          ]
        }
      ],
      "datePublic": "2018-10-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-04T20:57:01",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2018-10-04T00:00:00",
          "ID": "CVE-2018-17891",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Vue RIS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Carestream"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-17891",
    "datePublished": "2018-10-04T21:00:00Z",
    "dateReserved": "2018-10-02T00:00:00",
    "dateUpdated": "2024-09-17T02:32:31.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}