PT-2023-21736 · Unknown · Hl7 Fhir Core Libraries

Jlleitschuh · Publicado 2023-03-10 · Atualizado 2023-12-15 · CVE-2023-28465

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HL7 FHIR Core Libraries versions prior to 5.6.106

Description The issue allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. This is due to an incomplete fix for a previous issue.

Recommendations For versions prior to 5.6.106, update to version 5.6.106 or later to resolve the issue. As a temporary workaround, consider restricting access to the package-decompression feature to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-28465

GHSA-9654-PR4F-GH6M

Produtos afetados

Hl7 Fhir Core Libraries

Referências · 12

• https://github.com/hapifhir/org.hl7.fhir.core · Nota
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-9654-pr4f-gh6m · Nota
• https://github.com/hapifhir/org.hl7.fhir.core/pull/1162 · Nota
• https://github.com/hapifhir/org.hl7.fhir.core/blob/b0daf666725fa14476d147522155af1e81922aac/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/terminologies/TerminologyCacheManager.java#L99-L105 · Nota
• https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/5.6.106 · Nota
• https://smilecdr.com/our-blog · Nota
• https://twitter.com/CVEnew/status/1734626780756259091 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-28465 · Nota de Segurança
• https://github.com/advisories/GHSA-9654-pr4f-gh6m · Nota
• https://smilecdr.com/our-blog/statement-on-cve-2023-24057-smile-digital-health · Nota
• https://osv.dev/vulnerability/CVE-2023-28465 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9654-pr4f-gh6m · Aviso do Fabricante