Medium severity · published Dec 12, 2019
CVE-2019-17428
An issue was discovered in Intesync Solismed 3.3sp1
5.9
CVSS
0.6%
EPSS
No
On KEV
Description
An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the database to be decrypted.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Solismed · Intesync
3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17428
Third Party Advisory
https://know.bishopfox.com/advisories
Exploit
https://know.bishopfox.com/advisories/solismed-critical
Product
https://www.solismed.com/
More from Solismed
9.8
CVE-2019-16246
Intesync Solismed 3.3sp1 allows Local File Inclusion (LFI), a different vulnerability than CVE-2019-15931
9.8
CVE-2019-15936
Intesync Solismed 3.3sp allows Insecure File Upload
9.8
CVE-2019-15933
Intesync Solismed 3.3sp has SQL Injection
9.8
CVE-2019-15932
Intesync Solismed 3.3sp has Incorrect Access Control
9.8
CVE-2019-15931
Intesync Solismed 3.3sp allows Directory Traversal, a different vulnerability than CVE-2019-16246