Details of VAR-201809-1091

ID

VAR-201809-1091

CVE

CVE-2018-8850

TITLE

Philips e-Alert Unit Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-010697

DESCRIPTION

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not validate input properly, allowing an attacker to craft the input in a form that is not expected by the rest of the application. This would lead to parts of the unit receiving unintended input, which may result in altered control flow, arbitrary control of a resource, or arbitrary code execution. Philips e-Alert Unit Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Philips e-Alert is prone to the following security vulnerabilities: 1. An input-validation vulnerability 2. A cross-site scripting vulnerability 3. Multiple information-disclosure vulnerabilities 4. An insecure default permissions vulnerability 5. A cross-site request-forgery vulnerability 6. A session-fixation vulnerability 7. A denial-of-service vulnerability 8. A security-bypass vulnerability Attackers may exploit these issues to gain unauthorized access to the affected device, or to bypass certain security restrictions to perform unauthorized actions, to compromise the application to access or modify data and to exploit vulnerabilities in the underlying database, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site or to execute arbitrary code within the context of the affected device. e-Alert R2.1 and prior are vulnerable. Philips e-Alert is an electronic alert solution for MRI systems from Philips, the Netherlands. It is mainly used to monitor the performance of MRI systems and issue alerts. An input validation vulnerability exists in Philips e-Alert R2.1 and earlier versions

Trust: 1.98

sources: NVD: CVE-2018-8850 // JVNDB: JVNDB-2018-010697 // BID: 105194 // VULHUB: VHN-138882

AFFECTED PRODUCTS

vendor:	philips	model:	e-alert	scope:	lte	version:	r2.1	Trust: 1.8
vendor:	philips	model:	e-alert	scope:	eq	version:	r2.1	Trust: 0.6
vendor:	philips	model:	e-alert r2.1	scope:	-	version:	-	Trust: 0.3
vendor:	philips	model:	e-alert r2	scope:	-	version:	-	Trust: 0.3

sources: BID: 105194 // JVNDB: JVNDB-2018-010697 // CNNVD: CNNVD-201809-110 // NVD: CVE-2018-8850

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-8850
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2018-8850
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201809-110
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-138882
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-8850
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-138882
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-8850
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-138882 // JVNDB: JVNDB-2018-010697 // CNNVD: CNNVD-201809-110 // NVD: CVE-2018-8850

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-138882 // JVNDB: JVNDB-2018-010697 // NVD: CVE-2018-8850

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201809-110

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201809-110

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-010697

PATCH

title:	Philips e-Alert Unit Vulnerabilities (30-AUG-2018)	url:	https://www.usa.philips.com/healthcare/about/customer-support/product-security	Trust: 0.8
title:	Philips e-Alert Enter the fix for the verification vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84471	Trust: 0.6

sources: JVNDB: JVNDB-2018-010697 // CNNVD: CNNVD-201809-110

EXTERNAL IDS

db:	ICS CERT	id:	ICSA-18-242-01	Trust: 2.8
db:	NVD	id:	CVE-2018-8850	Trust: 2.8
db:	BID	id:	105194	Trust: 2.0
db:	JVNDB	id:	JVNDB-2018-010697	Trust: 0.8
db:	CNNVD	id:	CNNVD-201809-110	Trust: 0.7
db:	VULHUB	id:	VHN-138882	Trust: 0.1

sources: VULHUB: VHN-138882 // BID: 105194 // JVNDB: JVNDB-2018-010697 // CNNVD: CNNVD-201809-110 // NVD: CVE-2018-8850

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-18-242-01	Trust: 2.8
url:	http://www.securityfocus.com/bid/105194	Trust: 1.7
url:	https://www.usa.philips.com/healthcare/about/customer-support/product-security	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-8850	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-8850	Trust: 0.8

sources: VULHUB: VHN-138882 // BID: 105194 // JVNDB: JVNDB-2018-010697 // CNNVD: CNNVD-201809-110 // NVD: CVE-2018-8850

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 105194

SOURCES

db:	VULHUB	id:	VHN-138882
db:	BID	id:	105194
db:	JVNDB	id:	JVNDB-2018-010697
db:	CNNVD	id:	CNNVD-201809-110
db:	NVD	id:	CVE-2018-8850

LAST UPDATE DATE

2024-11-23T22:26:13.015000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-138882	date:	2019-10-09T00:00:00
db:	BID	id:	105194	date:	2018-08-30T00:00:00
db:	JVNDB	id:	JVNDB-2018-010697	date:	2018-12-20T00:00:00
db:	CNNVD	id:	CNNVD-201809-110	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-8850	date:	2024-11-21T04:14:26.963

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-138882	date:	2018-09-26T00:00:00
db:	BID	id:	105194	date:	2018-08-30T00:00:00
db:	JVNDB	id:	JVNDB-2018-010697	date:	2018-12-20T00:00:00
db:	CNNVD	id:	CNNVD-201809-110	date:	2018-09-04T00:00:00
db:	NVD	id:	CVE-2018-8850	date:	2018-09-26T19:29:02.160