Lucene search

[email protected]NVD:CVE-2024-3699

HistoryJun 10, 2024 - 12:15 p.m.

CVE-2024-3699

2024-06-1012:15:10

CWE-798

[email protected]

web.nvd.nist.gov

security

hard-coded password

sensitive data

dreryk gabinet

cve-2024-3699

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

27.3%

JSON

Use of hard-coded password to the patients’ database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all drEryk Gabinet installations.This issue affects drEryk Gabinet software versions from 7.0.0.0 through 9.17.0.0.

Affected configurations

Nvd

Node

drerykgabinetRange7.0.0.0–9.17.0.0

VendorProductVersionCPE
drerykgabinet*cpe:2.3:a:dreryk:gabinet:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dreryk	gabinet	*	cpe:2.3:a:dreryk:gabinet::::::::

References

cert.pl/en/posts/2024/06/CVE-2024-1228/

cert.pl/posts/2024/06/CVE-2024-1228/

dreryk.pl/produkty/gabinet/

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

27.3%

JSON

Related for NVD:CVE-2024-3699

cvelist1 vulnrichment1 cve1