Privilege escalation in Change Healthcare McKesson and Horizon Cardiology
| Risk | Low |
| Patch available | NO |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-18630 |
| CWE-ID | CWE-276 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Change Healthcare Cardiology Hardware solutions / Medical equipment McKesson Cardiology Hardware solutions / Medical equipment Horizon Cardiology Hardware solutions / Medical equipment |
| Vendor | Change Healthcare |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Incorrect default permissions
EUVDB-ID: #VU20485
Risk: Low
CVSSv3.1: 7.1 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2018-18630
CWE-ID:
CWE-276 - Incorrect Default Permissions
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure file permissions in the default installation. A local authenticated attacker can insert specially crafted files that can result in arbitrary code execution.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsChange Healthcare Cardiology: 14.1.x
McKesson Cardiology: 13.x - 14.x
Horizon Cardiology: 11.x - 12.x
External linkshttp://ics-cert.us-cert.gov/advisories/icsma-19-241-01
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
