ID

VAR-201803-2089


CVE

CVE-2018-5468


TITLE

Philips Intellispace Portal Vulnerabilities related to authorization, permissions, and access control

Trust: 0.8

sources: JVNDB: JVNDB-2018-003329

DESCRIPTION

Philips Intellispace Portal all versions 7.0.x and 8.0.x have a remote desktop access vulnerability that could allow an attacker to gain unauthorized access and in some cases escalate their level of privilege or execute arbitrary code. Philips Intellispace Portal Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Philips Intellispace Portal can process clinical images from different modes and enables advanced visualization of the images. ISP systems are deployed in the healthcare and public health sectors. Philips Intellispace Portal is prone to the following security vulnerabilities. 1. A remote code-execution vulnerability 2. Multiple privilege-escalation vulnerabilities 3. This may lead to complete compromise of the device. Intellispace Portal versions 8.0.x and 7.0.x are vulnerable. The system provides viewing of echographic images and a single point of access for physicians. An elevation of privilege vulnerability exists in Philips ISP versions 7.0.x and 8.0.x

Trust: 2.52

sources: NVD: CVE-2018-5468 // JVNDB: JVNDB-2018-003329 // CNVD: CNVD-2018-03814 // BID: 103182 // VULHUB: VHN-135499

AFFECTED PRODUCTS

vendor:philipsmodel:intellispace portalscope:eqversion:8.0

Trust: 1.9

vendor:philipsmodel:intellispace portalscope:eqversion:9.0

Trust: 1.6

vendor:philipsmodel:intellispace portalscope:eqversion:8.0.x

Trust: 1.4

vendor:philipsmodel:intellispace portalscope:eqversion:7.0.x

Trust: 1.4

vendor:philipsmodel:intellispace portalscope:eqversion:7.0

Trust: 0.3

sources: CNVD: CNVD-2018-03814 // BID: 103182 // JVNDB: JVNDB-2018-003329 // CNNVD: CNNVD-201803-941 // NVD: CVE-2018-5468

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-5468
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-5468
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-03814
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201803-941
value: CRITICAL

Trust: 0.6

VULHUB: VHN-135499
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-5468
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-03814
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-135499
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-5468
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-03814 // VULHUB: VHN-135499 // JVNDB: JVNDB-2018-003329 // CNNVD: CNNVD-201803-941 // NVD: CVE-2018-5468

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: VULHUB: VHN-135499 // JVNDB: JVNDB-2018-003329 // NVD: CVE-2018-5468

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-941

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201803-941

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-003329

PATCH

title:Philips IntelliSpace Portal Vulnerabilities (26-FEB-2018)url:https://www.usa.philips.com/healthcare/about/customer-support/product-security

Trust: 0.8

title:Patch for Philips Intellispace Portal Privilege Escalation Vulnerability (CNVD-2018-03814)url:https://www.cnvd.org.cn/patchInfo/show/119267

Trust: 0.6

sources: CNVD: CNVD-2018-03814 // JVNDB: JVNDB-2018-003329

EXTERNAL IDS

db:NVDid:CVE-2018-5468

Trust: 3.4

db:ICS CERTid:ICSMA-18-058-02

Trust: 3.4

db:BIDid:103182

Trust: 2.0

db:JVNDBid:JVNDB-2018-003329

Trust: 0.8

db:CNNVDid:CNNVD-201803-941

Trust: 0.7

db:CNVDid:CNVD-2018-03814

Trust: 0.6

db:VULHUBid:VHN-135499

Trust: 0.1

sources: CNVD: CNVD-2018-03814 // VULHUB: VHN-135499 // BID: 103182 // JVNDB: JVNDB-2018-003329 // CNNVD: CNNVD-201803-941 // NVD: CVE-2018-5468

REFERENCES

url:https://ics-cert.us-cert.gov/advisories/icsma-18-058-02

Trust: 3.4

url:http://www.securityfocus.com/bid/103182

Trust: 1.7

url:https://www.usa.philips.com/healthcare/about/customer-support/product-security

Trust: 1.7

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5468

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2018-5468

Trust: 0.8

url:http://www.usa.philips.com/

Trust: 0.3

sources: CNVD: CNVD-2018-03814 // VULHUB: VHN-135499 // BID: 103182 // JVNDB: JVNDB-2018-003329 // CNNVD: CNNVD-201803-941 // NVD: CVE-2018-5468

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 103182

SOURCES

db:CNVDid:CNVD-2018-03814
db:VULHUBid:VHN-135499
db:BIDid:103182
db:JVNDBid:JVNDB-2018-003329
db:CNNVDid:CNNVD-201803-941
db:NVDid:CVE-2018-5468

LAST UPDATE DATE

2024-08-14T12:36:55.826000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2018-03814date:2018-02-28T00:00:00
db:VULHUBid:VHN-135499date:2019-10-09T00:00:00
db:BIDid:103182date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-003329date:2018-05-22T00:00:00
db:CNNVDid:CNNVD-201803-941date:2019-10-17T00:00:00
db:NVDid:CVE-2018-5468date:2019-10-09T23:41:25.580

SOURCES RELEASE DATE

db:CNVDid:CNVD-2018-03814date:2018-02-28T00:00:00
db:VULHUBid:VHN-135499date:2018-03-26T00:00:00
db:BIDid:103182date:2018-02-27T00:00:00
db:JVNDBid:JVNDB-2018-003329date:2018-05-22T00:00:00
db:CNNVDid:CNNVD-201803-941date:2018-03-27T00:00:00
db:NVDid:CVE-2018-5468date:2018-03-26T14:29:00.543