github - ghsa-v26h-pr28-4w63

ghsa-v26h-pr28-4w63

Vulnerability from github

Published

2024-05-31 18:31

Modified

2024-05-31 18:31

Details

Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This issue affects Welch Allyn Configuration Tool: versions 1.9.4.1 and prior.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-5176"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-31T18:15:13Z",
    "severity": null
  },
  "details": "Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This issue affects Welch Allyn Configuration Tool: versions 1.9.4.1 and prior.",
  "id": "GHSA-v26h-pr28-4w63",
  "modified": "2024-05-31T18:31:17Z",
  "published": "2024-05-31T18:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5176"
    },
    {
      "type": "WEB",
      "url": "https://cisa.gov/news-events/ics-medical-advisories/icsma-24-151-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

cve-2024-5176

Vulnerability from cvelistv5

Published

2024-05-31 17:26

Modified

2024-09-03 15:31

Severity ?

9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Summary

Vulnerability in Welch Allyn Configuration Tool Software

References

▼	URL	Tags
	https://cisa.gov/news-events/ics-medical-advisories/icsma-24-151-01

Impacted products

▼	Vendor	Product
	Baxter	Welch Allyn Configuration Tool

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:03:11.030Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cisa.gov/news-events/ics-medical-advisories/icsma-24-151-01"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:baxter:welch_allyn_configuration_tool:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "welch_allyn_configuration_tool",
            "vendor": "baxter",
            "versions": [
              {
                "lessThanOrEqual": "1.9.4.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5176",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T15:30:10.899212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T15:31:58.511Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Welch Allyn Configuration Tool",
          "vendor": "Baxter",
          "versions": [
            {
              "lessThanOrEqual": "1.9.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Baxter reported this vulnerability to CISA."
        }
      ],
      "datePublic": "2024-05-30T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.\u003cp\u003eThis issue affects Welch Allyn Configuration Tool: versions 1.9.4.1 and prior.\u003c/p\u003e"
            }
          ],
          "value": "Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This issue affects Welch Allyn Configuration Tool: versions 1.9.4.1 and prior."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-555",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-555 Remote Services with Stolen Credentials"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-05T14:41:49.489Z",
        "orgId": "dba971b9-eb30-4121-91e1-3b45611354aa",
        "shortName": "Baxter"
      },
      "references": [
        {
          "url": "https://cisa.gov/news-events/ics-medical-advisories/icsma-24-151-01"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eBaxter has found no evidence to date of any compromise of personal or health data. Baxter will release a software update for all impacted software to address this vulnerability. A new version of the product that mitigates the vulnerability will be available as follows:\u003c/p\u003e\u003cul\u003e\u003cli\u003eWelch Allyn Product Configuration Tool versions 1.9.4.2: Available Q3 2024\u003c/li\u003e\u003cli\u003eNo user action will be required once the update is released.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eBaxter recommends the following workarounds to help reduce risk:\u003c/p\u003e\u003cul\u003e\u003cli\u003eApply proper network and physical security controls.\u003c/li\u003e\u003cli\u003eThe Welch Allyn Configuration Tool has been removed from public access. Customers are advised to contact Baxter Technical Support or their Baxter Project Manager to create configuration files, as needed. Baxter Technical Support can be reached at (800)535-6663, option 2.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "Baxter has found no evidence to date of any compromise of personal or health data. Baxter will release a software update for all impacted software to address this vulnerability. A new version of the product that mitigates the vulnerability will be available as follows:\n\n  *  Welch Allyn Product Configuration Tool versions 1.9.4.2: Available Q3 2024\n  *  No user action will be required once the update is released.\n\n\nBaxter recommends the following workarounds to help reduce risk:\n\n  *  Apply proper network and physical security controls.\n  *  The Welch Allyn Configuration Tool has been removed from public access. Customers are advised to contact Baxter Technical Support or their Baxter Project Manager to create configuration files, as needed. Baxter Technical Support can be reached at (800)535-6663, option 2."
        }
      ],
      "source": {
        "advisory": "ICSMA-24-151-01",
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerability in Welch Allyn Configuration Tool Software",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dba971b9-eb30-4121-91e1-3b45611354aa",
    "assignerShortName": "Baxter",
    "cveId": "CVE-2024-5176",
    "datePublished": "2024-05-31T17:26:05.140Z",
    "dateReserved": "2024-05-21T16:07:59.038Z",
    "dateUpdated": "2024-09-03T15:31:58.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted