CVE-2019-10962

BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway Workstation does not prevent an attacker with knowledge of the IP address of the Alaris Gateway Workstation terminal to gain access to the status and configuration information of the device.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/108763	Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01	Mitigation Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.0.13:::::::*
	cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.3:10::::::
	cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.3:11::::::
	cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.5:::::::*
	cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.6:::::::*

cpe:2.3:h:bd:alaris_gateway_workstation:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-06-13 21:29

Updated : 2023-12-10 12:59

NVD link : CVE-2019-10962

Mitre link : CVE-2019-10962

CVE.ORG link : CVE-2019-10962

JSON object : View

Products Affected

bd

alaris_gateway_workstation
alaris_gateway_workstation_firmware

CWE

NVD-CWE-Other CWE-284

Improper Access Control

{"id": "CVE-2019-10962", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2019-06-13T21:29:15.877", "references": [{"url": "http://www.securityfocus.com/bid/108763", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway Workstation does not prevent an attacker with knowledge of the IP address of the Alaris Gateway Workstation terminal to gain access to the status and configuration information of the device."}, {"lang": "es", "value": "BD Alaris Gateway versiones, 1.0.13,1.1.3 Build 10.1.1.3 MR Build 11,1.1.5, y 1.1.6 El interfaz de un usuario del navegador web en el Alarias Gateway Workstation no impide a aun atacante con conocimiento de la direcci\u00f3n de el IP de el Alaris Gateway Workstation para conseguir acceso al estado y conseguir informaci\u00f3n de configuraci\u00f3n"}], "lastModified": "2020-10-02T14:34:46.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.0.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B20B97A8-51D4-4ACA-B237-BF6718C84233"}, {"criteria": "cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.3:10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8E78509-81FC-4AA8-8E9A-155336BBF8E9"}, {"criteria": "cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.3:11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4993ECBE-3E97-47BB-897F-77FCF31F7EAD"}, {"criteria": "cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2F66891-2DFE-440E-AF9C-5BD6FA9AA68F"}, {"criteria": "cpe:2.3:o:bd:alaris_gateway_workstation_firmware:1.1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D9581B3-999A-4198-A35A-90177AEC21E7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bd:alaris_gateway_workstation:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "506C8401-AF76-47C4-90EF-E6476C316230"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}