Critical severity · published Jun 10, 2024
CVE-2024-3699
Hardcoded password in drEryk Gabinet
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all drEryk Gabinet installations.This issue affects drEryk Gabinet software versions from 7.0.0.0 through 9.17.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DG
drEryk Gabinet · drEryk sp. z o.o.
7.0.0.0 through 9.17.0.0. · source: vendor
GA
Gabinet · Dreryk
7.0.0.0 before 9.17.0.0 · source: NVD, CISA