What is the CVSS score of CVE-2018-5438?

CVE-2018-5438 has a CVSS 3.0 base score of 6.3 (Medium). CVSS vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Intellispace Cardiovascular CVE-2018-5438

MEDIUM

Insufficient Session Expiration (CWE-613)

2018-03-20 ics-cert@hq.dhs.gov

Authentication Bypass Microsoft Intellispace Cardiovascular

6.3

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Mar 20, 2018 - 17:29 nvd

MEDIUM 6.3

DescriptionNVD

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record (EMR) system, where ISCV is in KIOSK mode for multiple users and using Windows authentication. This may allow an attacker to gain unauthorized access to patient health information and potentially modify this information.

AnalysisAI

Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. Rated medium severity (CVSS 6.3). No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-613. Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the session of a previously logged in user. This vulnerability exists when using ISCV together with an Electronic Medical Record (EMR) system, where ISCV is in KIOSK mode for multiple users and using Windows authentication. This may allow an attacker to gain unauthorized access to patient health information and potentially modify this information. Affected products include: Philips Intellispace Cardiovascular. Version information: version 2.3.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.