mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-29 09:41:31 +00:00
536 lines
15 KiB
JSON
536 lines
15 KiB
JSON
![]() |
{
|
||
|
"id": "CVE-2020-6977",
|
||
|
"sourceIdentifier": "ics-cert@hq.dhs.gov",
|
||
|
"published": "2020-02-20T21:15:11.787",
|
||
|
"lastModified": "2020-03-05T15:08:13.627",
|
||
|
"vulnStatus": "Analyzed",
|
||
|
"descriptions": [
|
||
|
{
|
||
|
"lang": "en",
|
||
|
"value": "A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user to escape the restricted environment, resulting in access to the underlying operating system. Affected devices include the following GE Ultrasound Products: Vivid products - all versions; LOGIQ - all versions not including LOGIQ 100 Pro; Voluson - all versions; Versana Essential - all versions; Invenia ABUS Scan station - all versions; Venue - all versions not including Venue 40 R1-3 and Venue 50 R4-5"
|
||
|
},
|
||
|
{
|
||
|
"lang": "es",
|
||
|
"value": "Se presenta una vulnerabilidad de escape del entorno de escritorio restringido en la funcionalidad Kiosk Mode de los dispositivos afectados. Las entradas especialmente dise\u00f1adas pueden permitir al usuario escapar del entorno restringido, resultando en el acceso al sistema operativo subyacente. Los dispositivos afectados incluyen los siguientes Productos GE Ultrasound: Productos Vivid- todas las versiones; LOGIQ todas las versiones sin incluir LOGIQ 100 Pro; Voluson- todas las versiones; Versana Essential- todas las versiones; estaci\u00f3n Invenia ABUS Scan- todas las versiones; Venue- todas las versiones sin incluir Venue 40 R1-3 y Venue 50 R4-5."
|
||
|
}
|
||
|
],
|
||
|
"metrics": {
|
||
|
"cvssMetricV31": [
|
||
|
{
|
||
|
"source": "nvd@nist.gov",
|
||
|
"type": "Primary",
|
||
|
"cvssData": {
|
||
|
"version": "3.1",
|
||
|
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
|
"attackVector": "PHYSICAL",
|
||
|
"attackComplexity": "LOW",
|
||
|
"privilegesRequired": "NONE",
|
||
|
"userInteraction": "NONE",
|
||
|
"scope": "UNCHANGED",
|
||
|
"confidentialityImpact": "HIGH",
|
||
|
"integrityImpact": "HIGH",
|
||
|
"availabilityImpact": "HIGH",
|
||
|
"baseScore": 6.8,
|
||
|
"baseSeverity": "MEDIUM"
|
||
|
},
|
||
|
"exploitabilityScore": 0.9,
|
||
|
"impactScore": 5.9
|
||
|
}
|
||
|
],
|
||
|
"cvssMetricV2": [
|
||
|
{
|
||
|
"source": "nvd@nist.gov",
|
||
|
"type": "Primary",
|
||
|
"cvssData": {
|
||
|
"version": "2.0",
|
||
|
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
|
||
|
"accessVector": "LOCAL",
|
||
|
"accessComplexity": "LOW",
|
||
|
"authentication": "NONE",
|
||
|
"confidentialityImpact": "COMPLETE",
|
||
|
"integrityImpact": "COMPLETE",
|
||
|
"availabilityImpact": "COMPLETE",
|
||
|
"baseScore": 7.2
|
||
|
},
|
||
|
"baseSeverity": "HIGH",
|
||
|
"exploitabilityScore": 3.9,
|
||
|
"impactScore": 10.0,
|
||
|
"acInsufInfo": false,
|
||
|
"obtainAllPrivilege": false,
|
||
|
"obtainUserPrivilege": false,
|
||
|
"obtainOtherPrivilege": false,
|
||
|
"userInteractionRequired": false
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
"weaknesses": [
|
||
|
{
|
||
|
"source": "nvd@nist.gov",
|
||
|
"type": "Primary",
|
||
|
"description": [
|
||
|
{
|
||
|
"lang": "en",
|
||
|
"value": "CWE-20"
|
||
|
},
|
||
|
{
|
||
|
"lang": "en",
|
||
|
"value": "NVD-CWE-Other"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"source": "ics-cert@hq.dhs.gov",
|
||
|
"type": "Secondary",
|
||
|
"description": [
|
||
|
{
|
||
|
"lang": "en",
|
||
|
"value": "CWE-693"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
],
|
||
|
"configurations": [
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:vivid_e95_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "8D5CFE13-6BB7-4AB5-A7B5-E9835F57153C"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:vivid_e95:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "AFFA0A88-A994-439F-8A2C-C5192497F95E"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:vivid_e90_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "E5626583-2827-481E-9D08-CF91B72FBB24"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:vivid_e90:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "FA30F2BA-90CD-48FF-8136-F6B803420D04"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:vivid_s70n_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "64175A54-FECA-440D-A7EE-13787C46CCB7"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:vivid_s70n:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "3CE98481-E7EB-42C3-A4C3-66AB05523BC4"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:vivid_t8_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "A732E1FF-C0BC-47A6-97C0-2ADCD3FF2F41"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:vivid_t8:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "0A4DCE57-C4F9-4A3D-8065-C347B6E2FBA2"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:vivid_t9_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "62FE1705-2A1A-4C86-9C0F-DA9589425EC1"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:vivid_t9:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "C599B7B4-79C8-4F40-877C-9A1C03CABA09"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:vivid_iq_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "36D73039-53C4-4240-9181-95A8C4983A70"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:vivid_iq:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "687EB7A2-7E4D-47D3-9417-AD5B61C99950"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:logiq_e10_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "5B050014-FE29-447A-9F79-D81830453645"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:logiq_e10:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "B654C47B-9E53-436E-AF9B-5C7B9F9662D0"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:logiq_e9_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "CE6210B1-9F2A-411D-B593-8B4B82BFEB0B"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:logiq_e9:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "9119C872-186E-4030-AA29-CCF283ED4760"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:logiq_s8_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "6397FD39-BE3D-46C6-8EF5-197F9BDD62AD"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:logiq_s8:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "592EC130-0AC6-4CCC-B55D-564761E28AA1"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:logiq_s7_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "3B8A2821-540F-4432-8C64-672D5F47471A"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:logiq_s7:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "721D0EC4-2C6C-4037-A6F5-2903FE96BD24"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:logiq_p9_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "FCB8B4F9-2988-425B-BB74-E4AFD34F3011"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:logiq_p9:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "3DF46C72-0F91-415C-A66E-A36496ABBCCA"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:logiq_e9_with_xdclear_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "F9A7B94D-19D4-425B-8FE3-CBCBA73E1D9D"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:logiq_e9_with_xdclear:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "9330CC77-EC30-44BA-9760-59B0911F8B3F"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:voluson_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "4A3C089D-BBD4-4A63-A054-A944225389A1"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:voluson:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "DF6F6762-240B-41B3-9B88-E1165AD09ECB"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:versana_essential_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "4DE77AE1-431F-462F-9972-E8DA61F79F92"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:versana_essential:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "24CFA4A8-8F47-47B1-A8CB-94472624ACAF"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:invenia_abus_scan_station_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "091C8777-9A9C-4E1F-9E6B-10BDFDB88B40"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:invenia_abus_scan_station:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "E4D48120-6BFF-44EA-B1A8-0532C67D1346"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "AND",
|
||
|
"nodes": [
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": true,
|
||
|
"criteria": "cpe:2.3:o:ge:venue_go_firmware:*:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "85BECC99-91F0-43C0-A3EB-D447A9D1227B"
|
||
|
}
|
||
|
]
|
||
|
},
|
||
|
{
|
||
|
"operator": "OR",
|
||
|
"negate": false,
|
||
|
"cpeMatch": [
|
||
|
{
|
||
|
"vulnerable": false,
|
||
|
"criteria": "cpe:2.3:h:ge:venue_go:-:*:*:*:*:*:*:*",
|
||
|
"matchCriteriaId": "5BFD24F4-3D3C-4545-9A02-F56429901DF8"
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
}
|
||
|
],
|
||
|
"references": [
|
||
|
{
|
||
|
"url": "https://www.us-cert.gov/ics/advisories/icsma-20-049-02",
|
||
|
"source": "ics-cert@hq.dhs.gov",
|
||
|
"tags": [
|
||
|
"Third Party Advisory",
|
||
|
"US Government Resource"
|
||
|
]
|
||
|
}
|
||
|
]
|
||
|
}
|