CVE-2021-23207CWE-256

Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password

Medium · published January 21, 2022

CVSS v3.1
6.5
EPSS
0%
Percentile
11.6
In the wild
Unconfirmed
What it is

An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ queues and messages by impersonating users.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00218 · 11.6th percentile
Weakness
CWE-256 · Plaintext Storage of a Password
Published
2022-01-21T18:17Z
EPSS history
Timeline
  • 21 JAN 18:17Z
    Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password
    cvelistv5