Sign-up

ID

VAR-201803-1808


CVE

CVE-2018-5472


TITLE

Philips Intellispace Portal Vulnerabilities related to authorization, permissions, and access control

Trust: 0.8

sources: JVNDB: JVNDB-2018-003331

DESCRIPTION

Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could allow an attacker to gain unauthorized access and in some cases escalate their level of privilege or execute arbitrary code. Philips Intellispace Portal Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Philips Intellispace Portal can process clinical images from different modes and enables advanced visualization of the images. ISP systems are deployed in the healthcare and public health sectors. Philips Intellispace Portal is prone to the following security vulnerabilities. 1. A remote code-execution vulnerability 2. Multiple privilege-escalation vulnerabilities 3. This may lead to complete compromise of the device. Intellispace Portal versions 8.0.x and 7.0.x are vulnerable. The system provides viewing of echographic images and a single point of access for physicians. An elevation of privilege vulnerability exists in Philips ISP versions 8.0.x and 7.0.x

Trust: 2.52

sources: NVD: CVE-2018-5472 // JVNDB: JVNDB-2018-003331 // CNVD: CNVD-2018-03813 // BID: 103182 // VULHUB: VHN-135503

AFFECTED PRODUCTS

vendor:philipsmodel:intellispace portalscope:eqversion:8.0

Trust: 1.9

vendor:philipsmodel:intellispace portalscope:eqversion:9.0

Trust: 1.6

vendor:philipsmodel:intellispace portalscope:eqversion:8.0.x

Trust: 1.4

vendor:philipsmodel:intellispace portalscope:eqversion:7.0.x

Trust: 1.4

vendor:philipsmodel:intellispace portalscope:eqversion:7.0

Trust: 0.3

sources: CNVD: CNVD-2018-03813 // BID: 103182 // JVNDB: JVNDB-2018-003331 // CNNVD: CNNVD-201803-773 // NVD: CVE-2018-5472

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-5472
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-5472
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-03813
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201803-773
value: CRITICAL

Trust: 0.6

VULHUB: VHN-135503
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-5472
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-03813
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-135503
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-5472
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-03813 // VULHUB: VHN-135503 // JVNDB: JVNDB-2018-003331 // CNNVD: CNNVD-201803-773 // NVD: CVE-2018-5472

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: VULHUB: VHN-135503 // JVNDB: JVNDB-2018-003331 // NVD: CVE-2018-5472

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-773

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201803-773

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-003331

PATCH
title:Philips IntelliSpace Portal Vulnerabilities (26-FEB-2018)url:https://www.usa.philips.com/healthcare/about/customer-support/product-security
Trust: 0.8
title:Patch for Philips Intellispace Portal Privilege Escalation Vulnerability (CNVD-2018-03813)url:https://www.cnvd.org.cn/patchInfo/show/119265
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-03813 // 
            
            
            
            JVNDB: JVNDB-2018-003331

EXTERNAL IDS
db:NVDid:CVE-2018-5472
Trust: 3.4
db:ICS CERTid:ICSMA-18-058-02
Trust: 3.4
db:BIDid:103182
Trust: 2.0
db:JVNDBid:JVNDB-2018-003331
Trust: 0.8
db:CNNVDid:CNNVD-201803-773
Trust: 0.7
db:CNVDid:CNVD-2018-03813
Trust: 0.6
db:VULHUBid:VHN-135503
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-03813 // 
            
            
            
            VULHUB: VHN-135503 // 
            
            
            
            BID: 103182 // 
            
            
            
            JVNDB: JVNDB-2018-003331 // 
            
            
            
            CNNVD: CNNVD-201803-773 // 
            
            
            
            NVD: CVE-2018-5472

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsma-18-058-02
Trust: 3.4
url:http://www.securityfocus.com/bid/103182
Trust: 1.7
url:https://www.usa.philips.com/healthcare/about/customer-support/product-security
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5472
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-5472
Trust: 0.8
url:http://www.usa.philips.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-03813 // 
            
            
            
            VULHUB: VHN-135503 // 
            
            
            
            BID: 103182 // 
            
            
            
            JVNDB: JVNDB-2018-003331 // 
            
            
            
            CNNVD: CNNVD-201803-773 // 
            
            
            
            NVD: CVE-2018-5472

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 103182

SOURCES
db:CNVDid:CNVD-2018-03813
db:VULHUBid:VHN-135503
db:BIDid:103182
db:JVNDBid:JVNDB-2018-003331
db:CNNVDid:CNNVD-201803-773
db:NVDid:CVE-2018-5472

LAST UPDATE DATE
2024-08-14T12:44:39.796000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-03813date:2018-02-28T00:00:00
db:VULHUBid:VHN-135503date:2019-10-09T00:00:00
db:BIDid:103182date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-003331date:2018-05-22T00:00:00
db:CNNVDid:CNNVD-201803-773date:2019-10-17T00:00:00
db:NVDid:CVE-2018-5472date:2019-10-09T23:41:26.377

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-03813date:2018-02-28T00:00:00
db:VULHUBid:VHN-135503date:2018-03-26T00:00:00
db:BIDid:103182date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-003331date:2018-05-22T00:00:00
db:CNNVDid:CNNVD-201803-773date:2018-03-22T00:00:00
db:NVDid:CVE-2018-5472date:2018-03-26T14:29:00.650