{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1228", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2024-02-05T13:46:45.179Z", "datePublished": "2024-06-10T11:13:44.453Z", "dateUpdated": "2024-06-11T13:30:49.683Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Eurosoft Przychodnia", "vendor": "EuroSoft Sp. z o. o.", "versions": [{"lessThan": "20240417.001", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Eurosoft Przychodnia installations.<br><br><div><p>This issue affects Eurosoft Przychodnia software before&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">version</span>&nbsp;20240417.001 (from that version vulnerability is fixed).</p></div>"}], "value": "Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Eurosoft Przychodnia installations.\n\nThis issue affects Eurosoft Przychodnia software before\u00a0version\u00a020240417.001 (from that version vulnerability is fixed)."}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H/AU:Y/R:U/V:C/RE:M/U:Red", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2024-06-10T11:18:47.633Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2024/06/CVE-2024-1228/"}, {"tags": ["third-party-advisory"], "url": "https://cert.pl/posts/2024/06/CVE-2024-1228/"}, {"tags": ["product"], "url": "https://www.eurosoft.com.pl/eurosoft-przychodnia"}], "source": {"discovery": "UNKNOWN"}, "title": "Hardcoded password in Eurosoft Przychodnia", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "eurosoftsp.zo.o", "product": "eurosoft_przychodina", "cpes": ["cpe:2.3:a:eurosoftsp.zo.o:eurosoft_przychodina:20240417.001:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "20240417.001", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-10T13:42:43.489051Z", "id": "CVE-2024-1228", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-11T13:30:49.683Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eurosoft:przychodnia:*:*:*:*:*:*:*:*", "matchCriteriaId": "0EF7775C-026C-4F8E-8C72-0ECECF0AB425", "versionEndExcluding": "20240417.001", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Eurosoft Przychodnia installations.\n\nThis issue affects Eurosoft Przychodnia software before\u00a0version\u00a020240417.001 (from that version vulnerability is fixed)."}, {"lang": "es", "value": "El uso de una contrase\u00f1a codificada para la base de datos de los pacientes permite a un atacante recuperar datos confidenciales almacenados en la base de datos. La contrase\u00f1a es la misma en todas las instalaciones de Eurosoft Przychodnia. Este problema afecta al software Eurosoft Przychodnia antes de la versi\u00f3n 20240417.001 (a partir de esa versi\u00f3n se soluciona la vulnerabilidad)."}], "id": "CVE-2024-1228", "lastModified": "2024-06-12T17:54:10.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-06-10T12:15:09.430", "references": [{"source": "cvd@cert.pl", "tags": ["Third Party Advisory"], "url": "https://cert.pl/en/posts/2024/06/CVE-2024-1228/"}, {"source": "cvd@cert.pl", "tags": ["Third Party Advisory"], "url": "https://cert.pl/posts/2024/06/CVE-2024-1228/"}, {"source": "cvd@cert.pl", "tags": ["Product"], "url": "https://www.eurosoft.com.pl/eurosoft-przychodnia"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-798"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}