VulnerabilityModified
CVE-2016-4328
MEDHOST Perioperative Information Management System (aka PIMS or VPIMS) before 2015R1 has hardcoded credentials, which makes it easier for remote attackers to obtain sensitive information via direct requests to the application database server.
CRITICAL 9.8EPSS 3.96%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.96%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
MEDHOST Perioperative Information Management System (aka PIMS or VPIMS) before 2015R1 has hardcoded credentials, which makes it easier for remote attackers to obtain sensitive information via direct requests to the application database server.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.96% probability · 90th percentile
- CISA KEV
- Not listed
- Affected
- medhost/perioperative information management system
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/482135Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/482135Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.