CVEvulnerability

CVE-2021-23233

9.8 CRITICAL Published 2022-01-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-01-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-284, CWE-798

Description

Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacker can send requests to sensitive endpoints as an unauthenticated user to perform critical actions or modify critical configuration parameters.

Affected configurations

• fresenius-kabi agilia partner maintenance software (<= 3.3.0) • fresenius-kabi vigilant centerium 1.0 • fresenius-kabi vigilant insight 1.0 • fresenius-kabi vigilant mastermed 1.0 • fresenius-kabi agilia connect firmware (<= d25) • fresenius-kabi link\+ agilia firmware (< 3.0) • fresenius-kabi link\+ agilia firmware 3.0

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References