Security Advisory

CVE-2019-12741

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2019-06-05 14:58:44

Last updated 2024-08-04 23:32:55

Assigner mitre

State PUBLISHED

Description

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.)

← Browse all CVEs View on cve.org ↗