Incorrect default permissions in Change Healthcare products - CVE-2018-18630
Published: August 30, 2019
Vulnerability identifier: #VU20485
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-18630
CWE-ID: CWE-276
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure file permissions in the default installation. A local authenticated attacker can insert specially crafted files that can result in arbitrary code execution.
Affected software
Horizon Cardiology
McKesson Cardiology
Change Healthcare Cardiology
McKesson Cardiology
Change Healthcare Cardiology
How to mitigate CVE-2018-18630
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.