Lucene search

IcscertCVE-2018-5470

HistoryMar 26, 2018 - 2:29 p.m.

CVE-2018-5470

2018-03-2614:29:00

CWE-426

CWE-428

icscert

web.nvd.nist.gov

cve-2018-5470

philips intellispace portal

vulnerability

unquoted search path

arbitrary code execution

privilege escalation

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

Percentile

9.5%

JSON

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an unquoted search path or element vulnerability that has been identified, which may allow an authorized local user to execute arbitrary code and escalate their level of privileges.

Affected configurations

Nvd

Node

philipsintellispace_portalMatch8.0

philipsintellispace_portalMatch9.0

VendorProductVersionCPE
philipsintellispace_portal8.0cpe:2.3:a:philips:intellispace_portal:8.0:*:*:*:*:*:*:*
philipsintellispace_portal9.0cpe:2.3:a:philips:intellispace_portal:9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
philips	intellispace_portal	8.0	cpe:2.3:a:philips:intellispace_portal:8.0:::::::*
philips	intellispace_portal	9.0	cpe:2.3:a:philips:intellispace_portal:9.0:::::::*

CNA Affected

[
  {
    "product": "Philips IntelliSpace Portal",
    "vendor": "Philips",
    "versions": [
      {
        "status": "affected",
        "version": "8.0.x"
      },
      {
        "status": "affected",
        "version": "7.0.x"
      }
    ]
  }
]

References

www.securityfocus.com/bid/103182

ics-cert.us-cert.gov/advisories/ICSMA-18-058-02

www.usa.philips.com/healthcare/about/customer-support/product-security

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

Percentile

9.5%

JSON

Related for CVE-2018-5470