CVE-2024-6796

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker to gain unauthorized access to Connex portal's database and/or modify content.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Baxter	Connex Health Portal	< 8/30/2024
hillrom	connex_health_portal	< 8.30.2024

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-249-01Third Party Advisory, US Government Resource

Timeline

Published: Sep 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-67974.8The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users suc CVE-2024-67984.8The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users s CVE-2024-67994.3The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit CVE-2024-68009.8An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity CVE-2024-68019.8A vulnerability, which was classified as critical, has been found in SourceCodester Online Student Management System 1.0. This issue affects CVE-2024-68029.8A vulnerability, which was classified as critical, was found in SourceCodester Computer Laboratory Management System 1.0. Affected is an unk CVE-2024-68039.8A vulnerability has been found in itsourcecode Document Management System 1.0 and classified as critical. Affected by this vulnerability is CVE-2024-68045.4The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and incl CVE-2024-68059.8The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may CVE-2024-68069.8The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may resul CVE-2024-68073.4A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0 and classified as problematic. Affected by this CVE-2024-68089.8A vulnerability was found in itsourcecode Simple Task List 1.0. It has been classified as critical. This affects the function insertUserReco