CVE-2018-17891

3.7 lowEPSS 0.7%

Low (3.7) in carestream carestream vue ris. EPSS 0.7% chance of exploitation in the next 30 days.

Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a more elaborate attack.

Severity

CVSS 3.0

3.7 low

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-209
Published: 2018-10-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

carestream:carestream_vue_ris

References

https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01
https://ics-cert.us-cert.gov/advisories/ICSMA-18-277-01

Check your stack JSON