CVE-2018-17891

LOW 3.7CVE-2018-17891 · Published 04/10/2018 · updated 17/06/2026

In short

CVE-2018-17891 is a LOW (CVSS 3.7) vulnerability affecting carestream vue ris (carestream).
Chance of exploitation in the next 30 days (EPSS): 0.73%, higher than 54.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
carestream vue ris carestream	`≤ 11.2`	No fix yet

Description

Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack.

References

ics-cert.us-cert.gov/advisories/ICSMA-18-277-01 · Mitigation

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free