CVE-2018-5438 - Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user

Back Back to CVE browser

MEDIUM

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user

Published Mar 20, 2018

6.3

MEDIUM

CVSS 3.0

EPSS 0.44%

Description

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record (EMR) system, where ISCV is in KIOSK mode for multiple users and using Windows authentication. This may allow an attacker to gain unauthorized access to patient health information and potentially modify this information.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-613

References (3)

http://www.securityfocus.com/bid/102847
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-18-025-01
x_refsource_MISCMitigationThird Party AdvisoryUS Government Resource
https://www.usa.philips.com/healthcare/about/customer-support/product-security
x_refsource_CONFIRMMitigationVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/102847		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-18-025-01		x_refsource_MISCMitigationThird Party AdvisoryUS Government Resource
https://www.usa.philips.com/healthcare/about/customer-support/product-security		x_refsource_CONFIRMMitigationVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner icscert

Published Mar 20, 2018

Updated Aug 5, 2024

Reserved Jan 12, 2018

Link CVE-2018-5438

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-5438

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-5438