CVE-2014-5405

Hospira MedNet before 6.1 uses a hardcoded cleartext password to control SQL database authorization, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.

CVSS v2.0 9.0 HIGH

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://ics-cert.us-cert.gov/advisories/ICSA-15-090-03	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:hospira:mednet:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-04-03 10:59

Updated : 2023-12-10 11:31

NVD link : CVE-2014-5405

Mitre link : CVE-2014-5405

CVE.ORG link : CVE-2014-5405

JSON object : View

Products Affected

hospira

mednet

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2014-5405", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-04-03T10:59:02.290", "references": [{"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-090-03", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Hospira MedNet before 6.1 uses a hardcoded cleartext password to control SQL database authorization, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password."}, {"lang": "es", "value": "Hospira MedNet anterior a 6.1 utiliza una contrase\u00f1a en texto claro embebida para controlar la autorizaci\u00f3n de la base de datos SQL, lo que permite a usuarios remotos autenticados evadir las restricciones de acceso mediante el aprovechamiento del conocimiento de esta contrase\u00f1a."}], "lastModified": "2015-07-24T14:51:00.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hospira:mednet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "891CFD8D-5C12-4A8E-AEA1-928165D0B56B", "versionEndIncluding": "5.8"}], "operator": "OR"}]}], "evaluatorImpact": "Per https://ics-cert.us-cert.gov/advisories/ICSA-15-090-03:\n\n\u201cThe MedNet software contains plaintext storage of passwords for the SQL database that may allow an attacker to compromise the MedNet SQL server and gain administrative access to the workstation.\u201d\n\nBased on this information, the score has been adjusted. For additional information or questions please contact ICS-CERT (contact information available via advisory link).", "sourceIdentifier": "ics-cert@hq.dhs.gov"}