CVE-2023-39227 - OpenCVE

Softneta MedDream PACS stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate user’s credentials.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Softneta	Meddream Pacs

Configuration 1 [-]

cpe:2.3:a:softneta:meddream_pacs:*:*:*:*:premium:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01

History

Wed, 25 Sep 2024 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-09-11T19:08:08.109Z

Updated: 2024-09-25T19:58:43.390Z

Reserved: 2023-08-18T16:28:34.432Z

Link: CVE-2023-39227

Vulnrichment

Updated: 2024-08-02T18:02:06.660Z

NVD

Status : Modified

Published: 2023-09-11T20:15:09.493

Modified: 2023-11-07T04:17:28.807

Link: CVE-2023-39227

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-39227", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-08-18T16:28:34.432Z", "datePublished": "2023-09-11T19:08:08.109Z", "dateUpdated": "2024-09-25T19:58:43.390Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MedDream PACS", "vendor": "Softneta", "versions": [{"lessThanOrEqual": " v7.2.8.810", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "\u200bNoam Moshe of Claroty Research reported these vulnerabilities to CISA."}], "datePublic": "2023-09-05T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\u200bSoftneta MedDream PACS <span style=\"background-color: rgb(255, 255, 255);\">stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate user\u2019s credentials.</span>\n\n"}], "value": "\u200bSoftneta MedDream PACS\u00a0stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate user\u2019s credentials.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-256", "description": "CWE-256 \u200bPlaintext Storage of a Password", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-09-11T19:08:08.109Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>\u200bSoftneta recommends users update to <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/files/meddreampacs/premium/230530/MedDream-PACS-Premium-7.2.9.820.exe\">v7.2.9.820</a> of MedDream PACS Server or patch their current system using <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/files/meddreampacs/premium/Fix-v230712.zip\">Fix-v230712</a>.</p><p>\u200bFor assistance or additional information about installing the software, please <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/contacts/\">contact Softneta</a> directly.</p>\n\n<br>"}], "value": "\n\u200bSoftneta recommends users update to v7.2.9.820 https://www.softneta.com/files/meddreampacs/premium/230530/MedDream-PACS-Premium-7.2.9.820.exe \u00a0of MedDream PACS Server or patch their current system using Fix-v230712 https://www.softneta.com/files/meddreampacs/premium/Fix-v230712.zip .\n\n\u200bFor assistance or additional information about installing the software, please contact Softneta https://www.softneta.com/contacts/ \u00a0directly.\n\n\n\n\n"}], "source": {"advisory": "\u200b\u200bICSMA-23-248-01", "discovery": "EXTERNAL"}, "title": "\u200bSoftneta MedDream PACS Plaintext Storage of a Password", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:02:06.660Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-25T16:17:48.446169Z", "id": "CVE-2023-39227", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-25T19:58:43.390Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:02:06.660Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-39227", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-25T16:17:48.446169Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-25T19:58:32.977Z"}}], "cna": {"title": "\u200bSoftneta MedDream PACS Plaintext Storage of a Password", "source": {"advisory": "\u200b\u200bICSMA-23-248-01", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "\u200bNoam Moshe of Claroty Research reported these vulnerabilities to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Softneta", "product": "MedDream PACS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": " v7.2.8.810"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\n\u200bSoftneta recommends users update to v7.2.9.820 https://www.softneta.com/files/meddreampacs/premium/230530/MedDream-PACS-Premium-7.2.9.820.exe \u00a0of MedDream PACS Server or patch their current system using Fix-v230712 https://www.softneta.com/files/meddreampacs/premium/Fix-v230712.zip .\n\n\u200bFor assistance or additional information about installing the software, please contact Softneta https://www.softneta.com/contacts/ \u00a0directly.\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<p>\u200bSoftneta recommends users update to <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/files/meddreampacs/premium/230530/MedDream-PACS-Premium-7.2.9.820.exe\">v7.2.9.820</a> of MedDream PACS Server or patch their current system using <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/files/meddreampacs/premium/Fix-v230712.zip\">Fix-v230712</a>.</p><p>\u200bFor assistance or additional information about installing the software, please <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.softneta.com/contacts/\">contact Softneta</a> directly.</p>\n\n<br>", "base64": false}]}], "datePublic": "2023-09-05T17:00:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\u200bSoftneta MedDream PACS\u00a0stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate user\u2019s credentials.\n\n", "supportingMedia": [{"type": "text/html", "value": "\u200bSoftneta MedDream PACS <span style=\"background-color: rgb(255, 255, 255);\">stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate user\u2019s credentials.</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-256", "description": "CWE-256 \u200bPlaintext Storage of a Password"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-09-11T19:08:08.109Z"}}}, "cveMetadata": {"cveId": "CVE-2023-39227", "state": "PUBLISHED", "dateUpdated": "2024-09-25T19:58:43.390Z", "dateReserved": "2023-08-18T16:28:34.432Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2023-09-11T19:08:08.109Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}