« Volver al listado

CVE-2024-6795

Estado: AnalizadaCrítica (9.8)—

In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database.

An attacker could have submitted a crafted payload to Connex portal that could have resulted in modification and disclosure of database content

and/or perform administrative operations including shutting down the database.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Baxter — Connex Health Portal

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-6795",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6795",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-09T20:04:42.779977Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "productsecurity@baxter.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "productsecurity@baxter.com",
      "affectedData": [
        {
          "vendor": "Baxter",
          "product": "Connex Health Portal",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "8/30/2024",
              "versionType": "date"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:hillrom:connex_health_portal:*:*:*:*:*:*:*:*"
          ],
          "vendor": "hillrom",
          "product": "connex_health_portal",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "8.30.2024",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-09-09T20:15:05.253",
  "references": [
    {
      "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-249-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "productsecurity@baxter.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productsecurity@baxter.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database. \n\nAn attacker could have submitted a crafted payload to Connex portal that could have resulted in modification and disclosure of database content \n\nand/or perform administrative operations including shutting down the database."
    },
    {
      "lang": "es",
      "value": "En el portal de salud Connex publicado antes del 30/8/2024, se encontraron vulnerabilidades de inyección SQL que podrían haber permitido que un atacante no autenticado obtuviera acceso no autorizado a la base de datos del portal Connex. Un atacante podría haber enviado un payload manipulado al portal Connex que podría haber dado lugar a la modificación y divulgación del contenido de la base de datos y/o a la realización de operaciones administrativas, incluido el cierre de la base de datos."
    }
  ],
  "lastModified": "2026-06-17T08:18:43.797",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:baxter:connex_health_portal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21E3F634-BFB7-4605-91ED-E03F8EA2E7C4",
              "versionEndExcluding": "2024-08-30"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productsecurity@baxter.com"
}