Lucene search

IcscertCVE-2021-33848

HistoryJan 21, 2022 - 7:15 p.m.

CVE-2021-33848

2022-01-2119:15:09

CWE-79

icscert

web.nvd.nist.gov

cve-2021-33848

fresenius kabi vigilant

software suite

mastermed dashboard

xss

reflected xss

security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

40.6%

JSON

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks. An attacker could inject JavaScript in a GET parameter of HTTP requests and perform unauthorized actions such as stealing internal information and performing actions in context of an authenticated user.

Affected configurations

Nvd

Node

fresenius-kabiagilia_connect_firmwareRange≤d25

AND

fresenius-kabiagilia_connectMatch-

Node

fresenius-kabiagilia_partner_maintenance_softwareRange≤3.3.0

fresenius-kabivigilant_centeriumMatch1.0

fresenius-kabivigilant_insightMatch1.0

fresenius-kabivigilant_mastermedMatch1.0

Node

fresenius-kabilink\+_agilia_firmwareRange<3.0

fresenius-kabilink\+_agilia_firmwareMatch3.0-

fresenius-kabilink\+_agilia_firmwareMatch3.0d15

AND

fresenius-kabilink\+_agiliaMatch-

VendorProductVersionCPE
fresenius-kabiagilia_connect_firmware*cpe:2.3:o:fresenius-kabi:agilia_connect_firmware:*:*:*:*:*:*:*:*
fresenius-kabiagilia_connect-cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:*
fresenius-kabiagilia_partner_maintenance_software*cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:*
fresenius-kabivigilant_centerium1.0cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:*
fresenius-kabivigilant_insight1.0cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:*
fresenius-kabivigilant_mastermed1.0cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:*
fresenius-kabilink\+_agilia_firmware*cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:*
fresenius-kabilink\+_agilia_firmware3.0cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:*
fresenius-kabilink\+_agilia_firmware3.0cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:*
fresenius-kabilink\+_agilia-cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fresenius-kabi	agilia_connect_firmware	*	cpe:2.3:o:fresenius-kabi:agilia_connect_firmware::::::::
fresenius-kabi	agilia_connect	-	cpe:2.3:h:fresenius-kabi:agilia_connect:-:::::::*
fresenius-kabi	agilia_partner_maintenance_software	*	cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software::::::::
fresenius-kabi	vigilant_centerium	1.0	cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:::::::*
fresenius-kabi	vigilant_insight	1.0	cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:::::::*
fresenius-kabi	vigilant_mastermed	1.0	cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:::::::*
fresenius-kabi	link\+_agilia_firmware	*	cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware::::::::
fresenius-kabi	link\+_agilia_firmware	3.0	cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-::::::
fresenius-kabi	link\+_agilia_firmware	3.0	cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15::::::
fresenius-kabi	link\+_agilia	-	cpe:2.3:h:fresenius-kabi:link\+_agilia:-:::::::*

CNA Affected

[
  {
    "product": "Vigilant Software Suite (Mastermed Dashboard)",
    "vendor": "Fresenius Kabi",
    "versions": [
      {
        "lessThan": "2.0.1.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsma-21-355-01

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

40.6%

JSON

Related for CVE-2021-33848