Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    3 vulnerabilities by Carestream

    VAR-201810-0478

    Vulnerability from variot - Updated: 2023-12-18 13:13

    Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack. Carestream Vue RIS Contains an information disclosure vulnerability.Information may be obtained. An attacker could exploit this vulnerability to obtain technical information

    Show details on source website
    To clipboard 

    {
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201810-0478",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "vue ris",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "carestream",
        "version": "11.2"
      },
      {
        "model": "vue ris",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "carestream",
        "version": "11.2"
      },
      {
        "model": "vue ris",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "carestream",
        "version": "ris client builds 11.2"
      },
      {
        "model": "vue ris",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "carestream",
        "version": "\u003c=11.2"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "carestream vue ris",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "BID",
        "id": "105713"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:carestream:carestream_vue_ris:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "11.2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Dan Regalado of Zingbox",
    "sources": [
      {
        "db": "BID",
        "id": "105713"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-17891",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2018-17891",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 4.9,
            "id": "CNVD-2018-21171",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "LOW",
            "trust": 0.6,
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 4.9,
            "id": "7d856950-463f-11e9-bb98-000c29342cb1",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "LOW",
            "trust": 0.2,
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
            "version": "2.9 [IVD]"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.2,
            "impactScore": 1.4,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 3.7,
            "baseSeverity": "Low",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2018-17891",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2018-17891",
            "trust": 1.8,
            "value": "LOW"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2018-21171",
            "trust": 0.6,
            "value": "LOW"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201810-156",
            "trust": 0.6,
            "value": "LOW"
          },
          {
            "author": "IVD",
            "id": "7d856950-463f-11e9-bb98-000c29342cb1",
            "trust": 0.2,
            "value": "LOW"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack. Carestream Vue RIS Contains an information disclosure vulnerability.Information may be obtained. An attacker could exploit this vulnerability to obtain technical information",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "BID",
        "id": "105713"
      },
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      }
    ],
    "trust": 2.61
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-17891",
        "trust": 3.5
      },
      {
        "db": "ICS CERT",
        "id": "ICSMA-18-277-01",
        "trust": 2.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568",
        "trust": 0.8
      },
      {
        "db": "BID",
        "id": "105713",
        "trust": 0.3
      },
      {
        "db": "IVD",
        "id": "7D856950-463F-11E9-BB98-000C29342CB1",
        "trust": 0.2
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "BID",
        "id": "105713"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "id": "VAR-201810-0478",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      }
    ],
    "trust": 1.4
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      }
    ]
  },
  "last_update_date": "2023-12-18T13:13:39.900000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CARESTREAM Vue RIS",
        "trust": 0.8,
        "url": "https://www.carestream.com/en/us/medical/products/vue-healthit/radiology/carestream-vue-ris"
      },
      {
        "title": "Patch for Carestream Vue RIS Information Disclosure Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/142569"
      },
      {
        "title": "Carestream Vue RIS Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=86164"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-200",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.7,
        "url": "https://ics-cert.us-cert.gov/advisories/icsma-18-277-01"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-17891"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17891"
      },
      {
        "trust": 0.3,
        "url": "https://www.carestream.com"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "BID",
        "id": "105713"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "BID",
        "id": "105713"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-10-18T00:00:00",
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "date": "2018-10-17T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "date": "2018-10-04T00:00:00",
        "db": "BID",
        "id": "105713"
      },
      {
        "date": "2018-12-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "date": "2018-10-04T21:29:01.983000",
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "date": "2018-10-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-11-01T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "date": "2018-10-04T00:00:00",
        "db": "BID",
        "id": "105713"
      },
      {
        "date": "2018-12-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-010568"
      },
      {
        "date": "2019-10-09T23:37:00.050000",
        "db": "NVD",
        "id": "CVE-2018-17891"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Carestream Vue RIS Information Disclosure Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "7d856950-463f-11e9-bb98-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-21171"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ],
    "trust": 1.4
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "information disclosure",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201810-156"
      }
    ],
    "trust": 0.6
  }
}

    CVE-2018-17891 (GCVE-0-2018-17891)

    Vulnerability from cvelistv5 – Published: 2018-10-04 21:00 – Updated: 2024-09-17 02:32
    VLAI
    Summary
    Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack.
    Severity
    No CVSS data available.
    CWE
    • CWE-209 - INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209
    Assigner
    References
    Impacted products
    Vendor Product Version
    Carestream Vue RIS Affected: RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5
    		Create a notification for this product.
    Date Public
    2018-10-04 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:01:14.459Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Vue RIS",
          "vendor": "Carestream",
          "versions": [
            {
              "status": "affected",
              "version": "RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5"
            }
          ]
        }
      ],
      "datePublic": "2018-10-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-04T20:57:01.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2018-10-04T00:00:00",
          "ID": "CVE-2018-17891",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Vue RIS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Carestream"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-17891",
    "datePublished": "2018-10-04T21:00:00.000Z",
    "dateReserved": "2018-10-02T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:32:31.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2018-17891 (GCVE-0-2018-17891)

    Vulnerability from nvd – Published: 2018-10-04 21:00 – Updated: 2024-09-17 02:32
    VLAI
    Summary
    Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack.
    Severity
    No CVSS data available.
    CWE
    • CWE-209 - INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209
    Assigner
    References
    Impacted products
    Vendor Product Version
    Carestream Vue RIS Affected: RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5
    		Create a notification for this product.
    Date Public
    2018-10-04 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:01:14.459Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Vue RIS",
          "vendor": "Carestream",
          "versions": [
            {
              "status": "affected",
              "version": "RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5"
            }
          ]
        }
      ],
      "datePublic": "2018-10-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-04T20:57:01.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2018-10-04T00:00:00",
          "ID": "CVE-2018-17891",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Vue RIS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Carestream"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "INFORMATION EXPOSURE THROUGH AN ERROR MESSAGE CWE-209"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-17891",
    "datePublished": "2018-10-04T21:00:00.000Z",
    "dateReserved": "2018-10-02T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:32:31.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}