Vulnerability · Published Jun 10, 2024 · Assigned by CERT-PL

CVE-2024-1228Hardcoded password in Eurosoft Przychodnia

Critical 9.3

In plain English

A critical-severity security flaw in Eurosoft Przychodnia from EuroSoft Sp. z o. o.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.4%top 64.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Eurosoft Przychodnia installations. This issue affects Eurosoft Przychodnia software before version 20240417.001 (from that version vulnerability is fixed).

Affected products (as reported)

Vendor	Product	Versions
EuroSoft Sp. z o. o.	Eurosoft Przychodnia	0 – before 20240417.001

Weakness: CWE-259 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H/AU:Y/R:U/V:C/RE:M/U:Red

References

https://cert.pl/en/posts/2024/06/CVE-2024-1228/ third-party-advisory
https://cert.pl/posts/2024/06/CVE-2024-1228/ third-party-advisory
https://www.eurosoft.com.pl/eurosoft-przychodnia product