Lucene search

CERT-PLCVE-2024-1228

HistoryJun 10, 2024 - 12:15 p.m.

CVE-2024-1228

2024-06-1012:15:09

CWE-798

CERT-PL

web.nvd.nist.gov

eurosoft przychodnia

hard-coded password

data retrieval

vulnerability

database

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

9.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:H/VA:H/SA:H/AU:Y/U:Red/R:U/V:C/RE:M

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

27.3%

JSON

Use of hard-coded password to the patients’ database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Eurosoft Przychodnia installations.

This issue affects Eurosoft Przychodnia software before version 20240417.001 (from that version vulnerability is fixed).

Affected configurations

Nvd

Node

eurosoftprzychodniaRange<20240417.001

VendorProductVersionCPE
eurosoftprzychodnia*cpe:2.3:a:eurosoft:przychodnia:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eurosoft	przychodnia	*	cpe:2.3:a:eurosoft:przychodnia::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Eurosoft Przychodnia",
    "vendor": "EuroSoft Sp. z o. o.",
    "versions": [
      {
        "lessThan": "20240417.001",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

cert.pl/en/posts/2024/06/CVE-2024-1228/

cert.pl/posts/2024/06/CVE-2024-1228/

www.eurosoft.com.pl/eurosoft-przychodnia

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

9.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:H/VA:H/SA:H/AU:Y/U:Red/R:U/V:C/RE:M

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

27.3%

JSON

Related for CVE-2024-1228