Sign-up

ID

VAR-201803-2089


CVE

CVE-2018-5468


TITLE

Philips Intellispace Portal Vulnerabilities related to authorization, permissions, and access control

Trust: 0.8

sources: JVNDB: JVNDB-2018-003329

DESCRIPTION

Philips Intellispace Portal all versions 7.0.x and 8.0.x have a remote desktop access vulnerability that could allow an attacker to gain unauthorized access and in some cases escalate their level of privilege or execute arbitrary code. Philips Intellispace Portal Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Philips Intellispace Portal can process clinical images from different modes and enables advanced visualization of the images. ISP systems are deployed in the healthcare and public health sectors. Philips Intellispace Portal is prone to the following security vulnerabilities. 1. A remote code-execution vulnerability 2. Multiple privilege-escalation vulnerabilities 3. This may lead to complete compromise of the device. Intellispace Portal versions 8.0.x and 7.0.x are vulnerable. The system provides viewing of echographic images and a single point of access for physicians. An elevation of privilege vulnerability exists in Philips ISP versions 7.0.x and 8.0.x

Trust: 2.52

sources: NVD: CVE-2018-5468 // JVNDB: JVNDB-2018-003329 // CNVD: CNVD-2018-03814 // BID: 103182 // VULHUB: VHN-135499

AFFECTED PRODUCTS

vendor:philipsmodel:intellispace portalscope:eqversion:8.0

Trust: 1.9

vendor:philipsmodel:intellispace portalscope:eqversion:9.0

Trust: 1.6

vendor:philipsmodel:intellispace portalscope:eqversion:8.0.x

Trust: 1.4

vendor:philipsmodel:intellispace portalscope:eqversion:7.0.x

Trust: 1.4

vendor:philipsmodel:intellispace portalscope:eqversion:7.0

Trust: 0.3

sources: CNVD: CNVD-2018-03814 // BID: 103182 // JVNDB: JVNDB-2018-003329 // CNNVD: CNNVD-201803-941 // NVD: CVE-2018-5468

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-5468
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-5468
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-03814
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201803-941
value: CRITICAL

Trust: 0.6

VULHUB: VHN-135499
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-5468
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-03814
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-135499
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-5468
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-03814 // VULHUB: VHN-135499 // JVNDB: JVNDB-2018-003329 // CNNVD: CNNVD-201803-941 // NVD: CVE-2018-5468

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: VULHUB: VHN-135499 // JVNDB: JVNDB-2018-003329 // NVD: CVE-2018-5468

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-941

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201803-941

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-003329

PATCH
title:Philips IntelliSpace Portal Vulnerabilities (26-FEB-2018)url:https://www.usa.philips.com/healthcare/about/customer-support/product-security
Trust: 0.8
title:Patch for Philips Intellispace Portal Privilege Escalation Vulnerability (CNVD-2018-03814)url:https://www.cnvd.org.cn/patchInfo/show/119267
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-03814 // 
            
            
            
            JVNDB: JVNDB-2018-003329

EXTERNAL IDS
db:NVDid:CVE-2018-5468
Trust: 3.4
db:ICS CERTid:ICSMA-18-058-02
Trust: 3.4
db:BIDid:103182
Trust: 2.0
db:JVNDBid:JVNDB-2018-003329
Trust: 0.8
db:CNNVDid:CNNVD-201803-941
Trust: 0.7
db:CNVDid:CNVD-2018-03814
Trust: 0.6
db:VULHUBid:VHN-135499
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-03814 // 
            
            
            
            VULHUB: VHN-135499 // 
            
            
            
            BID: 103182 // 
            
            
            
            JVNDB: JVNDB-2018-003329 // 
            
            
            
            CNNVD: CNNVD-201803-941 // 
            
            
            
            NVD: CVE-2018-5468

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsma-18-058-02
Trust: 3.4
url:http://www.securityfocus.com/bid/103182
Trust: 1.7
url:https://www.usa.philips.com/healthcare/about/customer-support/product-security
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5468
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-5468
Trust: 0.8
url:http://www.usa.philips.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-03814 // 
            
            
            
            VULHUB: VHN-135499 // 
            
            
            
            BID: 103182 // 
            
            
            
            JVNDB: JVNDB-2018-003329 // 
            
            
            
            CNNVD: CNNVD-201803-941 // 
            
            
            
            NVD: CVE-2018-5468

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 103182

SOURCES
db:CNVDid:CNVD-2018-03814
db:VULHUBid:VHN-135499
db:BIDid:103182
db:JVNDBid:JVNDB-2018-003329
db:CNNVDid:CNNVD-201803-941
db:NVDid:CVE-2018-5468

LAST UPDATE DATE
2024-11-23T21:31:03.967000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-03814date:2018-02-28T00:00:00
db:VULHUBid:VHN-135499date:2019-10-09T00:00:00
db:BIDid:103182date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-003329date:2018-05-22T00:00:00
db:CNNVDid:CNNVD-201803-941date:2019-10-17T00:00:00
db:NVDid:CVE-2018-5468date:2024-11-21T04:08:51.617

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-03814date:2018-02-28T00:00:00
db:VULHUBid:VHN-135499date:2018-03-26T00:00:00
db:BIDid:103182date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-003329date:2018-05-22T00:00:00
db:CNNVDid:CNNVD-201803-941date:2018-03-27T00:00:00
db:NVDid:CVE-2018-5468date:2018-03-26T14:29:00.543