VulnerabilityModified
CVE-2015-6538
The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.
CRITICAL 9.8EPSS 1.88%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.88%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.88% probability · 78th percentile
- CISA KEV
- Not listed
- Affected
- ephiphanyheathdata/cardio server
- Source
- cve@mitre.org
References
- http://www.epiphanyhealthdata.com/blog/certresponseVendor Advisory
- https://www.kb.cert.org/vuls/id/630239Third Party Advisory, US Government Resource
- http://www.epiphanyhealthdata.com/blog/certresponseVendor Advisory
- https://www.kb.cert.org/vuls/id/630239Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.