CVE-2022-30277 (GCVE-0-2022-30277)
Vulnerability from cvelistv5 – Published: 2022-06-01 16:38 – Updated: 2024-09-16 17:43
VLAI?
Summary
BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII).
Severity ?
5.7 (Medium)
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Becton Dickinson (BD) | BD Synapsys™ |
Affected:
4.20 , ≤ 4.30
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:48:36.283Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "BD Synapsys\u2122",
"vendor": "Becton Dickinson (BD)",
"versions": [
{
"lessThanOrEqual": "4.30",
"status": "affected",
"version": "4.20",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "To exploit this vulnerability, a threat actor would need to gain access to the customer environment and physical access to a BD Synapsys\u2122 workstation."
}
],
"datePublic": "2022-05-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "BD Synapsys\u2122, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613 Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-01T16:38:50",
"orgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
"shortName": "BD"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration"
}
],
"solutions": [
{
"lang": "en",
"value": "BD Synapsys\u2122 v4.20 SR2 will be released in June 2022 and will remediate this vulnerability. Customers receiving BD Synapsys\u2122 v4.30 will be allowed to upgrade to v5.10, which is expected to be available by August 2022."
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "BD Synapsys\u2122 \u2013 Insufficient Session Expiration",
"workarounds": [
{
"lang": "en",
"value": "Configure the inactivity session timeout in the operating system to match the session expiration timeout in BD Synapsys\u2122. \n\nEnsure physical access controls are in place and only authorized end-users have access to BD Synapsys\u2122 workstations. \n\nPlace a reminder at each computer for users to logout when leaving the BD Synapsys\u2122 workstation. \n\nEnsure industry standard network security policies and procedures are followed."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@bd.com",
"DATE_PUBLIC": "2022-05-31T15:00:00.000Z",
"ID": "CVE-2022-30277",
"STATE": "PUBLIC",
"TITLE": "BD Synapsys\u2122 \u2013 Insufficient Session Expiration"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "BD Synapsys\u2122",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "4.20",
"version_value": "4.30"
}
]
}
}
]
},
"vendor_name": "Becton Dickinson (BD)"
}
]
}
},
"configuration": [
{
"lang": "en",
"value": "To exploit this vulnerability, a threat actor would need to gain access to the customer environment and physical access to a BD Synapsys\u2122 workstation."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "BD Synapsys\u2122, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII)."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-613 Insufficient Session Expiration"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration",
"refsource": "CONFIRM",
"url": "https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration"
}
]
},
"solution": [
{
"lang": "en",
"value": "BD Synapsys\u2122 v4.20 SR2 will be released in June 2022 and will remediate this vulnerability. Customers receiving BD Synapsys\u2122 v4.30 will be allowed to upgrade to v5.10, which is expected to be available by August 2022."
}
],
"source": {
"discovery": "INTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Configure the inactivity session timeout in the operating system to match the session expiration timeout in BD Synapsys\u2122. \n\nEnsure physical access controls are in place and only authorized end-users have access to BD Synapsys\u2122 workstations. \n\nPlace a reminder at each computer for users to logout when leaving the BD Synapsys\u2122 workstation. \n\nEnsure industry standard network security policies and procedures are followed."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
"assignerShortName": "BD",
"cveId": "CVE-2022-30277",
"datePublished": "2022-06-01T16:38:50.425711Z",
"dateReserved": "2022-05-04T00:00:00",
"dateUpdated": "2024-09-16T17:43:27.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:bd:synapsys:4.20:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"29718815-1C5E-4C2E-AB8E-95CC357DB0AD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:bd:synapsys:4.20:sr1:*:*:*:*:*:*\", \"matchCriteriaId\": \"ECEB919F-91F6-4ABF-8685-5C6385F96572\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:bd:synapsys:4.30:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B44B121C-256E-4E6D-8462-B37DFA60584C\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"BD Synapsys\\u2122, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII).\"}, {\"lang\": \"es\", \"value\": \"BD Synapsys\\u2122, versiones 4.20, 4.20 SR1, y 4.30, contienen una vulnerabilidad de expiraci\\u00f3n de sesi\\u00f3n insuficiente. Si es explotada, los actores de la amenaza pueden ser capaces de acceder, modificar o eliminar informaci\\u00f3n confidencial, incluyendo informaci\\u00f3n de salud electr\\u00f3nica protegida (ePHI), informaci\\u00f3n de salud protegida (PHI) e informaci\\u00f3n de identificaci\\u00f3n personal (PII)\"}]",
"id": "CVE-2022-30277",
"lastModified": "2024-11-21T07:02:29.147",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"cybersecurity@bd.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N\", \"baseScore\": 5.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"PHYSICAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 0.5, \"impactScore\": 5.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N\", \"baseScore\": 5.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"PHYSICAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 0.5, \"impactScore\": 5.2}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:P/A:N\", \"baseScore\": 3.6, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 4.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2022-06-02T14:15:51.850",
"references": "[{\"url\": \"https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration\", \"source\": \"cybersecurity@bd.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "cybersecurity@bd.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"cybersecurity@bd.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-613\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-613\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-30277\",\"sourceIdentifier\":\"cybersecurity@bd.com\",\"published\":\"2022-06-02T14:15:51.850\",\"lastModified\":\"2024-11-21T07:02:29.147\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"BD Synapsys\u2122, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII).\"},{\"lang\":\"es\",\"value\":\"BD Synapsys\u2122, versiones 4.20, 4.20 SR1, y 4.30, contienen una vulnerabilidad de expiraci\u00f3n de sesi\u00f3n insuficiente. Si es explotada, los actores de la amenaza pueden ser capaces de acceder, modificar o eliminar informaci\u00f3n confidencial, incluyendo informaci\u00f3n de salud electr\u00f3nica protegida (ePHI), informaci\u00f3n de salud protegida (PHI) e informaci\u00f3n de identificaci\u00f3n personal (PII)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cybersecurity@bd.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.5,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.5,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:N\",\"baseScore\":3.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cybersecurity@bd.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-613\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-613\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:bd:synapsys:4.20:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"29718815-1C5E-4C2E-AB8E-95CC357DB0AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:bd:synapsys:4.20:sr1:*:*:*:*:*:*\",\"matchCriteriaId\":\"ECEB919F-91F6-4ABF-8685-5C6385F96572\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:bd:synapsys:4.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B44B121C-256E-4E6D-8462-B37DFA60584C\"}]}]}],\"references\":[{\"url\":\"https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration\",\"source\":\"cybersecurity@bd.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…