Lucene search

[email protected]CVE-2021-43355

HistoryJan 21, 2022 - 7:15 p.m.

CVE-2021-43355

2022-01-2119:15:09

CWE-287

CWE-603

[email protected]

web.nvd.nist.gov

cve-2021-43355

fresenius kabi

vigilant software suite

unauthenticated input validation

client-side control

service privilege circumvention

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.6%

JSON

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support or block JavaScript or intentionally bypass the client-side checks. An attacker with knowledge of the service user could circumvent the client-side control and login with service privileges.

Affected configurations

NVD

Node

fresenius-kabiagilia_partner_maintenance_softwareRange≤3.3.0

fresenius-kabivigilant_centeriumMatch1.0

fresenius-kabivigilant_insightMatch1.0

fresenius-kabivigilant_mastermedMatch1.0

Node

fresenius-kabiagilia_connect_firmwareRange≤d25

AND

fresenius-kabiagilia_connectMatch-

Node

fresenius-kabilink\+_agilia_firmwareRange<3.0

fresenius-kabilink\+_agilia_firmwareMatch3.0-

fresenius-kabilink\+_agilia_firmwareMatch3.0d15

AND

fresenius-kabilink\+_agiliaMatch-

CPENameOperatorVersion
fresenius-kabi:agilia_partner_maintenance_softwarefresenius-kabi agilia partner maintenance softwarele3.3.0
fresenius-kabi:vigilant_centeriumfresenius-kabi vigilant centeriumeq1.0
fresenius-kabi:vigilant_insightfresenius-kabi vigilant insighteq1.0
fresenius-kabi:vigilant_mastermedfresenius-kabi vigilant mastermedeq1.0

CPE	Name	Operator	Version
fresenius-kabi:agilia_partner_maintenance_software	fresenius-kabi agilia partner maintenance software	le	3.3.0
fresenius-kabi:vigilant_centerium	fresenius-kabi vigilant centerium	eq	1.0
fresenius-kabi:vigilant_insight	fresenius-kabi vigilant insight	eq	1.0
fresenius-kabi:vigilant_mastermed	fresenius-kabi vigilant mastermed	eq	1.0

CNA Affected

[
  {
    "product": "Vigilant Software Suite (Mastermed Dashboard)",
    "vendor": "Fresenius Kabi",
    "versions": [
      {
        "lessThan": "2.0.1.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsma-21-355-01

Social References

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.6%

JSON

Related for CVE-2021-43355

cvelist1 nvd1 prion1 ics1