cvelist/2024/50xxx/CVE-2024-50588.json

{
    "data_version": "4.0",
    "data_type": "CVE",
    "data_format": "MITRE",
    "CVE_data_meta": {
        "ID": "CVE-2024-50588",
        "ASSIGNER": "security-research@sec-consult.com",
        "STATE": "PUBLIC"
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "An unauthenticated attacker with access to the local network of the \nmedical office can use known default credentials to gain remote DBA \naccess to the Elefant Firebird database. The data in the database \nincludes patient data and login credentials among other sensitive data. \nIn addition, this enables an attacker to create and overwrite arbitrary \nfiles on the server filesystem with the rights of the Firebird database \n(\"NT AUTHORITY\\SYSTEM\")."
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-1393 Use of Default Password",
                        "cweId": "CWE-1393"
                    }
                ]
            },
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-419 Unprotected Primary Channel",
                        "cweId": "CWE-419"
                    }
                ]
            }
        ]
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "HASOMED",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Elefant",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "=",
                                            "version_value": "<24.03.03"
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "references": {
        "reference_data": [
            {
                "url": "https://r.sec-consult.com/hasomed",
                "refsource": "MISC",
                "name": "https://r.sec-consult.com/hasomed"
            },
            {
                "url": "https://hasomed.de/produkte/elefant/",
                "refsource": "MISC",
                "name": "https://hasomed.de/produkte/elefant/"
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.2.0"
    },
    "source": {
        "discovery": "UNKNOWN"
    },
    "work_around": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "<p>While workarounds such as modifying the Elefant windows firewall \nrules and manually adjusting file permissions in the installation folder\n are feasible workarounds for some of the vulnerabilities, it is \nrecommended to install the patches provided by the vendor.</p>"
                }
            ],
            "value": "While workarounds such as modifying the Elefant windows firewall \nrules and manually adjusting file permissions in the installation folder\n are feasible workarounds for some of the vulnerabilities, it is \nrecommended to install the patches provided by the vendor."
        }
    ],
    "solution": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "<p>The vendor fixed the issue in version 24.03.03 (or higher) which can be downloaded from <a target=\"_blank\" rel=\"nofollow\" href=\"https://hasomed.de/produkte/elefant/\">hasomed.de/produkte/elefant/</a> or via the Elefant Software Updater.<br></p>"
                }
            ],
            "value": "The vendor fixed the issue in version 24.03.03 (or higher) which can be downloaded from  hasomed.de/produkte/elefant/ https://hasomed.de/produkte/elefant/  or via the Elefant Software Updater."
        }
    ],
    "credits": [
        {
            "lang": "en",
            "value": "Tobias Niemann, SEC Consult Vulnerability Lab"
        },
        {
            "lang": "en",
            "value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
        },
        {
            "lang": "en",
            "value": "Florian Stuhlmann, SEC Consult Vulnerability Lab"
        }
    ]
}