« Volver al listado

CVE-2018-10593

Estado: ModificadaMedia (5.6)—

A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in data corruption.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

BD — Database ManagerBD — PerformaBD — Reada

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-10593",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.8,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:M/Au:S/C:N/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.6,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 0.4
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Becton, Dickinson and Company",
          "product": "Kiestra and InoqulA systems",
          "versions": [
            {
              "status": "affected",
              "version": "Kiestra TLA, BD Kiestra WCA, and BD InoqulA+ specimen processor using Database (DB) Manager version 3.0.1.0, and previous, and PerformA version 3.0.0.0 and previous."
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-05-24T16:29:00.223",
  "references": [
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-142-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletin-bd-kiestra-tla-bd-kiestra-wca-bd-inoqula",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-18-142-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletin-bd-kiestra-tla-bd-kiestra-wca-bd-inoqula",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-356"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in data corruption."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en DB Manager en versiones 3.0.1.0 y anteriores y PerformA en versiones 3.0.0.0 y anteriores permite que un usuario autorizado con acceso a una cuenta privilegiada en un sistema BD Kiestra (Kiestra TLA, Kiestra WCA y InoqulA+ specimen processor) envíe comandos SQL, lo que podría resultar en una corrupción de datos."
    }
  ],
  "lastModified": "2026-06-17T01:34:14.217",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bd:database_manager:3.0.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26F5FF20-158E-4845-B552-8E23C0E4AA63"
            },
            {
              "criteria": "cpe:2.3:a:bd:performa:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C2D594E-9D02-4669-8F34-5CE1973F5C6F",
              "versionEndIncluding": "3.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:bd:reada:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A552AC5-880A-4EFE-875A-60E1F37DD127",
              "versionEndIncluding": "1.1.0.2"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bd:inoqula\\+:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "520604A4-38DE-4725-AD9D-1E6929E3619B"
            },
            {
              "criteria": "cpe:2.3:h:bd:kiestra_tla:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "80A40D4D-4BB9-45B1-BB10-C6ADCE2CFD56"
            },
            {
              "criteria": "cpe:2.3:h:bd:kiestra_wca:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0B172535-3DD4-46D6-9AF6-F8F795EC3747"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}