Vulnerabilities

TI-2021-19327 CVE-2021-43355 · GHSA-gc9x-xj3h-72v9

Fresenius Kabi Agilia Connect Infusion System use of client side authentication

MEDIUM 50

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00978 Published 2022-01-21 Fixed in 2.0.1.3 CWE-603

TI-2021-13193 CVE-2021-33848 · GHSA-3r3c-xv8w-hfp3

Fresenius Kabi Agilia Connect Infusion System cross site scripting

LOW 28

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00611 Published 2022-01-21 Fixed in 2.0.1.3 CWE-79

TI-2021-20073 CVE-2021-44464 · GHSA-jpmr-g8fr-7x23

Fresenius Kabi Agilia Connect Infusion System hard coded credentials

LOW 39

Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 contains service credentials likely to be common across all instances.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0064 Published 2022-01-21 Fixed in 2.0.1.3 CWE-798

TI-2021-05972 CVE-2021-23207 · GHSA-4r23-36c8-4wg2

Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password

LOW 28

An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00218 Published 2022-01-21 Fixed in 2.0.1.3, 3.0 CWE-256

TI-2021-05963 CVE-2021-23195 · GHSA-29g2-4fxx-7xmh

Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing

LOW 32

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activated.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00845 Published 2022-01-21 Fixed in 2.0.1.3 CWE-548

TI-2021-13191 CVE-2021-33846 · GHSA-vvwm-gcgm-h9j6

Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm

LOW 33

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00313 Published 2022-01-21 Fixed in 2.0.1.3 CWE-327