Lucene search

CERT-PLCVE-2024-3700

HistoryJun 10, 2024 - 12:15 p.m.

CVE-2024-3700

2024-06-1012:15:10

CWE-798

CERT-PL

web.nvd.nist.gov

hard-coded password

sensitive data

estomed sp.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

9.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:H/VA:H/SA:H/AU:Y/U:Red/R:U/V:C/RE:M

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

39.1%

JSON

Use of hard-coded password to the patients’ database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Simple Care software installations.

This issue affects Estomed Sp. z o.o. Simple Care software in all versions. The software is no longer supported.

Affected configurations

Nvd

Node

estomedsimple_care

VendorProductVersionCPE
estomedsimple_care*cpe:2.3:a:estomed:simple_care:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
estomed	simple_care	*	cpe:2.3:a:estomed:simple_care::::::::

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Simple Care",
    "vendor": "Estomed Sp. z o.o.",
    "versions": [
      {
        "status": "affected",
        "version": "all versions"
      }
    ]
  }
]

References

cert.pl/en/posts/2024/06/CVE-2024-1228/

cert.pl/posts/2024/06/CVE-2024-1228/

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

9.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:H/VA:H/SA:H/AU:Y/U:Red/R:U/V:C/RE:M

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

39.1%

JSON

Related for CVE-2024-3700