Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2021-43355
HistoryJan 21, 2022 - 7:15 p.m.

CVE-2021-43355

2022-01-2119:15:09
CWE-603
CWE-287
[email protected]
web.nvd.nist.gov
2
fresenius kabi vigilant software suite
validation bypass
client-side control
authentication
service privileges
cve-2021-43355

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

56.4%

JSON

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support or block JavaScript or intentionally bypass the client-side checks. An attacker with knowledge of the service user could circumvent the client-side control and login with service privileges.

Affected configurations

Nvd
Node
fresenius-kabiagilia_partner_maintenance_softwareRange≤3.3.0
OR
fresenius-kabivigilant_centeriumMatch1.0
OR
fresenius-kabivigilant_insightMatch1.0
OR
fresenius-kabivigilant_mastermedMatch1.0
Node
fresenius-kabiagilia_connect_firmwareRange≤d25
AND
fresenius-kabiagilia_connectMatch-
Node
fresenius-kabilink\+_agilia_firmwareRange<3.0
OR
fresenius-kabilink\+_agilia_firmwareMatch3.0-
OR
fresenius-kabilink\+_agilia_firmwareMatch3.0d15
AND
fresenius-kabilink\+_agiliaMatch-
VendorProductVersionCPE
fresenius-kabiagilia_partner_maintenance_software*cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:*
fresenius-kabivigilant_centerium1.0cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:*
fresenius-kabivigilant_insight1.0cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:*
fresenius-kabivigilant_mastermed1.0cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:*
fresenius-kabiagilia_connect_firmware*cpe:2.3:o:fresenius-kabi:agilia_connect_firmware:*:*:*:*:*:*:*:*
fresenius-kabiagilia_connect-cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:*
fresenius-kabilink\+_agilia_firmware*cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:*
fresenius-kabilink\+_agilia_firmware3.0cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:*
fresenius-kabilink\+_agilia_firmware3.0cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:*
fresenius-kabilink\+_agilia-cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:*

Related

cvelist 1
prion 1
cve 1
ics 1
cvelist
cvelist
CVE-2021-43355 Fresenius Kabi Agilia Connect Infusion System use of client side authentication
2022-01-21 18:17:44
prion
prion
Design/Logic Flaw
2022-01-21 19:15:00
cve
cve
CVE-2021-43355
2022-01-21 19:15:09
ics
ics
Fresenius Kabi Agilia Connect Infusion System (Update A)
2022-01-27 12:00:00

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

56.4%

JSON
Related for NVD:CVE-2021-43355
cvelist1prion1cve1ics1