PT-2017-16604 · Eclinicalworks · Eclinicalworks Patient Portal

Publicado 2017-01-27 · Atualizado 2017-02-01 · CVE-2017-5599

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions eClinicalWorks Patient Portal version 7.0 build 13

Description A reflected Cross Site Scripting issue affects the raceMasterList.jsp page within the Patient Portal. The inserted payload is rendered within the Patient Portal, and since the raceMasterList.jsp page does not require authentication, it can be exploited to extract sensitive information or perform attacks against the user's browser. The issue specifically involves the race parameter.

Recommendations For eClinicalWorks Patient Portal version 7.0 build 13, consider restricting access to the raceMasterList.jsp page until a fix is available, and avoid using the race parameter in this page to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-5599

Produtos afetados

Eclinicalworks Patient Portal

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-5599 · Nota de Segurança
• https://gist.github.com/malerisch/8a2c195f385dff7f935db831a8dc2697 · Nota
• http://securityfocus.com/bid/95835 · Nota
• https://osv.dev/vulnerability/CVE-2017-5599 · Aviso do Fabricante