CVE-2020-16218 Philips Patient Monitoring Devices Cross-site Scripting
Attackers can inject scripts into patient monitoring web interfaces to steal patient data via cross-site scripting.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-16218?
CVE-2020-16218 is a low-severity cross-site scripting vulnerability in Philips Patient Information Center iX (PICiX), published on 11 Sep 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is then used as a webpage and served to other users. Successful exploitation could lead to unauthorized access to patient data via a read-only web application.
Weakness: CWE-79
Which versions are affected by CVE-2020-16218?
It affects 1 product.
Products include Philips Patient Information Center Ix.
How do I fix CVE-2020-16218?
No fix has been published for CVE-2020-16218 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-16218 being exploited?
There is no known exploitation of CVE-2020-16218 in the wild and no public exploit code.
Other vulnerabilities in Philips Patient Information Center iX (PICiX)
- CVE-2020-16222 Philips Patient Monitoring Devices Improper Authentication
- CVE-2020-16212 Philips Patient Monitoring Devices Exposure of Resource to Wrong Sphere
- CVE-2021-43548 Philips Patient Information Center iX (PIC iX) and Efficia CM Series Improper Input Validation
- CVE-2020-16224 Philips Patient Monitoring Devices Improper Handling of Length Parameter Inconsistency
- CVE-2021-43552 Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic Key
Sources
Also known as GHSA-9p4m-gvr2-2mpp.