CVE-2018-17891

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack.

Metrics

CVSS 3.0 3.7/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209 CWE-200

Affected software

Vendor	Product	Versions
Carestream	Vue RIS	RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5

References

https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01Mitigation, Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Oct 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-178928.8NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security featu CVE-2018-178939.8LAquis SCADA Versions 4.1.0.3870 and prior has an untrusted pointer dereference vulnerability, which may allow remote code execution.CVE-2018-178949.8NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which could allow an attacker CVE-2018-178959.8LAquis SCADA Versions 4.1.0.3870 and prior has several out-of-bounds read vulnerabilities, which may allow remote code execution.CVE-2018-178968.1Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The affected controllers utilize hard-coded crede CVE-2018-178979.8LAquis SCADA Versions 4.1.0.3870 and prior has several integer overflow to buffer overflow vulnerabilities, which may allow remote code exec CVE-2018-178987.5Yokogawa STARDOM Controllers FCJ,FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The controller application fails to prevent memory CVE-2018-178998.8LAquis SCADA Versions 4.1.0.3870 and prior has a path traversal vulnerability, which may allow remote code execution.CVE-2018-17908.8IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allo CVE-2018-179009.8Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application improperly protects credentia CVE-2018-179017.8LAquis SCADA Versions 4.1.0.3870 and prior, when processing project files the application fails to sanitize user input prior to performing w CVE-2018-179025.3Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The application utilizes multiple methods of sess