CVE-2021-43355

· HIGHModified

← All CVEs

CVSS v3.1

7.3

EPSS

0.98%

Published

Jan 21, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support or block JavaScript or intentionally bypass the client-side checks. An attacker with knowledge of the service user could circumvent the client-side control and login with service privileges.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-603CWE-287

Affected Products (10)

fresenius-kabi · agilia_partner_maintenance_softwarevulnerable

fresenius-kabi · vigilant_centeriumvulnerable

fresenius-kabi · vigilant_insightvulnerable

fresenius-kabi · vigilant_mastermedvulnerable

fresenius-kabi · agilia_connect_firmwarevulnerable

fresenius-kabi · agilia_connect

fresenius-kabi · link\+_agilia_firmware (up to 3.0)vulnerable

fresenius-kabi · link\+_agilia_firmwarevulnerable

fresenius-kabi · link\+_agilia

References (2)

https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01

Third Party AdvisoryUS Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01

Third Party AdvisoryUS Government Resource

KEV Catalog EPSS Scores Vendors All CVEs