CVE-2024-3699 Hardcoded password in drEryk Gabinet
An attacker can access sensitive patient data in drEryk Gabinet due to a hardcoded database password shared across all installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3699?
CVE-2024-3699 is a critical vulnerability in drEryk Gabinet, published on 10 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all drEryk Gabinet installations.This issue affects drEryk Gabinet software versions from 7.0.0.0 through 9.17.0.0.
Which versions are affected by CVE-2024-3699?
It affects 1 product.
Products include Dreryk Gabinet.
How do I fix CVE-2024-3699?
No fix has been published for CVE-2024-3699 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-3699 being exploited?
There is no known exploitation of CVE-2024-3699 in the wild and no public exploit code.
Sources
Also known as GHSA-j37r-fj8f-2g89.