Code injection

2018-10-0421:29:00

PRIOn knowledge base

www.prio-n.com

3.9 Low

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.8%

JSON

Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack.

CPENameOperatorVersion
carestream_vue_risle11.2

CPE	Name	Operator	Version
	carestream_vue_ris	le	11.2

References

ics-cert.us-cert.gov/advisories/ICSMA-18-277-01