{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2024-50593",
        "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "state": "PUBLISHED",
        "assignerShortName": "SEC-VLab",
        "dateReserved": "2024-10-25T07:26:12.628Z",
        "datePublished": "2024-11-08T12:06:28.619Z",
        "dateUpdated": "2025-11-03T22:28:31.428Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "unaffected",
                    "product": "Elefant",
                    "vendor": "HASOMED",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "<24.03.03",
                            "versionType": "custom"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Tobias Niemann, SEC Consult Vulnerability Lab"
                },
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"
                },
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Florian Stuhlmann, SEC Consult Vulnerability Lab"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<p></p><p></p><p></p><p></p><p>An attacker with local access to the medical office computer can \naccess restricted functions of the Elefant Service tool by using a \nhard-coded \"Hotline\" password in the Elefant service binary, which is shipped with the software.</p><br><p></p><p></p><p></p>"
                        }
                    ],
                    "value": "An attacker with local access to the medical office computer can \naccess restricted functions of the Elefant Service tool by using a \nhard-coded \"Hotline\" password in the Elefant service binary, which is shipped with the software."
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-191",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-191 Read Sensitive Constants Within an Executable"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-798",
                            "description": "CWE-798 Use of Hard-coded Credentials",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
                "shortName": "SEC-VLab",
                "dateUpdated": "2024-11-08T12:06:28.619Z"
            },
            "references": [
                {
                    "tags": [
                        "third-party-advisory"
                    ],
                    "url": "https://r.sec-consult.com/hasomed"
                },
                {
                    "tags": [
                        "patch"
                    ],
                    "url": "https://hasomed.de/produkte/elefant/"
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<p>The vendor fixed the issue in version 24.03.03 (or higher) which can be downloaded from <a target=\"_blank\" rel=\"nofollow\" href=\"https://hasomed.de/produkte/elefant/\">hasomed.de/produkte/elefant/</a> or via the Elefant Software Updater.<br></p>"
                        }
                    ],
                    "value": "The vendor fixed the issue in version 24.03.03 (or higher) which can be downloaded from  hasomed.de/produkte/elefant/ https://hasomed.de/produkte/elefant/  or via the Elefant Software Updater."
                }
            ],
            "source": {
                "discovery": "UNKNOWN"
            },
            "title": "Hardcoded Service Password",
            "workarounds": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<p>While workarounds such as modifying the Elefant windows firewall \nrules and manually adjusting file permissions in the installation folder\n are feasible workarounds for some of the vulnerabilities, it is \nrecommended to install the patches provided by the vendor.</p>"
                        }
                    ],
                    "value": "While workarounds such as modifying the Elefant windows firewall \nrules and manually adjusting file permissions in the installation folder\n are feasible workarounds for some of the vulnerabilities, it is \nrecommended to install the patches provided by the vendor."
                }
            ],
            "x_generator": {
                "engine": "Vulnogram 0.2.0"
            }
        },
        "adp": [
            {
                "affected": [
                    {
                        "vendor": "hasomed",
                        "product": "elefant",
                        "cpes": [
                            "cpe:2.3:a:hasomed:elefant:*:*:*:*:*:*:*:*"
                        ],
                        "defaultStatus": "unknown",
                        "versions": [
                            {
                                "version": "0",
                                "status": "affected",
                                "lessThan": "24.03.03",
                                "versionType": "custom"
                            }
                        ]
                    }
                ],
                "metrics": [
                    {
                        "cvssV3_1": {
                            "scope": "UNCHANGED",
                            "version": "3.1",
                            "baseScore": 7.8,
                            "attackVector": "LOCAL",
                            "baseSeverity": "HIGH",
                            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                            "integrityImpact": "HIGH",
                            "userInteraction": "NONE",
                            "attackComplexity": "LOW",
                            "availabilityImpact": "HIGH",
                            "privilegesRequired": "LOW",
                            "confidentialityImpact": "HIGH"
                        }
                    },
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2024-11-08T15:40:19.870560Z",
                                "id": "CVE-2024-50593",
                                "options": [
                                    {
                                        "Exploitation": "poc"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2024-11-08T15:41:42.624Z"
                }
            },
            {
                "title": "CVE Program Container",
                "references": [
                    {
                        "url": "http://seclists.org/fulldisclosure/2024/Nov/3"
                    }
                ],
                "providerMetadata": {
                    "orgId": "af854a3a-2127-422b-91ae-364da2661108",
                    "shortName": "CVE",
                    "dateUpdated": "2025-11-03T22:28:31.428Z"
                }
            }
        ]
    }
}