Vulnerability · Published Sep 9, 2024 · Assigned by Baxter
CVE-2024-6795Vulnerability in Baxter Connex Health Portal
Critical 10.0
In plain English
A critical-severity SQL injection in Connex Health Portal from Baxter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attacker to gain unauthorized access to Connex portal's database. An attacker could have submitted a crafted payload to Connex portal that could have resulted in modification and disclosure of database content and/or perform administrative operations including shutting down the database.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Baxter | Connex Health Portal | 0 – before 8/30/2024 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H