cnvd - cnvd-2018-10605

CNVD-2018-10605

Vulnerability from cnvd - Published: 2018-05-30

Title

BeaconMedaes Scroll Medical Air Systems TotalAlert Web Application信息泄露漏洞（CNVD-2018-10605）

Description

BeaconMedaes Scroll Medical Air Systems是美国BeaconMedaes公司的一套医疗手术空气系统。TotalAlert Web Application是其中的一个基于Web的管理程序。 BeaconMedaes Scroll Medical Air Systems中的TotalAlert Web Application存在安全漏洞。攻击者可利用该漏洞检索没有被安全存储和传递的默认或用户定义的凭证。

Severity

高

Patch Name

BeaconMedaes Scroll Medical Air Systems TotalAlert Web Application信息泄露漏洞（CNVD-2018-10605）的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： http://www.beaconmedaes.com/

Reference

https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01

Impacted products

Name
BeaconMedaes Scroll Medical Air Systems <4107600010.23

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-7518"
    }
  },
  "description": "BeaconMedaes Scroll Medical Air Systems\u662f\u7f8e\u56fdBeaconMedaes\u516c\u53f8\u7684\u4e00\u5957\u533b\u7597\u624b\u672f\u7a7a\u6c14\u7cfb\u7edf\u3002TotalAlert Web Application\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u57fa\u4e8eWeb\u7684\u7ba1\u7406\u7a0b\u5e8f\u3002\r\n\r\nBeaconMedaes Scroll Medical Air Systems\u4e2d\u7684TotalAlert Web Application\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u68c0\u7d22\u6ca1\u6709\u88ab\u5b89\u5168\u5b58\u50a8\u548c\u4f20\u9012\u7684\u9ed8\u8ba4\u6216\u7528\u6237\u5b9a\u4e49\u7684\u51ed\u8bc1\u3002",
  "discovererName": "unknown",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttp://www.beaconmedaes.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-10605",
  "openTime": "2018-05-30",
  "patchDescription": "BeaconMedaes Scroll Medical Air Systems\u662f\u7f8e\u56fdBeaconMedaes\u516c\u53f8\u7684\u4e00\u5957\u533b\u7597\u624b\u672f\u7a7a\u6c14\u7cfb\u7edf\u3002TotalAlert Web Application\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u57fa\u4e8eWeb\u7684\u7ba1\u7406\u7a0b\u5e8f\u3002\r\n\r\nBeaconMedaes Scroll Medical Air Systems\u4e2d\u7684TotalAlert Web Application\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u68c0\u7d22\u6ca1\u6709\u88ab\u5b89\u5168\u5b58\u50a8\u548c\u4f20\u9012\u7684\u9ed8\u8ba4\u6216\u7528\u6237\u5b9a\u4e49\u7684\u51ed\u8bc1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "BeaconMedaes Scroll Medical Air Systems TotalAlert Web Application\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2018-10605\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "BeaconMedaes Scroll Medical Air Systems \u003c4107600010.23"
  },
  "referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01",
  "serverity": "\u9ad8",
  "submitTime": "2018-05-28",
  "title": "BeaconMedaes Scroll Medical Air Systems TotalAlert Web Application\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2018-10605\uff09"
}

CVE-2018-7518 (GCVE-0-2018-7518)

Vulnerability from cvelistv5 – Published: 2018-05-24 20:00 – Updated: 2024-09-16 22:41

Summary

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner.

Severity ?

No CVSS data available.

CWE

CWE-522 - INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522

Assigner

icscert

References

URL

Tags

https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	ICS-CERT	BeaconMedÃ¦s TotalAlert Scroll Medical Air Systems web application	Affected: All versions prior to version 4107600010.23

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:31:04.252Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BeaconMed\u0026#195;\u0026#166;s TotalAlert Scroll Medical Air Systems web application",
          "vendor": "ICS-CERT",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to version 4107600010.23"
            }
          ]
        }
      ],
      "datePublic": "2018-05-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-24T19:57:01",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2018-05-24T00:00:00",
          "ID": "CVE-2018-7518",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BeaconMed\u0026#195;\u0026#166;s TotalAlert Scroll Medical Air Systems web application",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior to version 4107600010.23"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ICS-CERT"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-7518",
    "datePublished": "2018-05-24T20:00:00Z",
    "dateReserved": "2018-02-26T00:00:00",
    "dateUpdated": "2024-09-16T22:41:11.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-10605

CVE-2018-7518 (GCVE-0-2018-7518)

Tags

Sightings

Nomenclature