PT-2026-22577 · Unknown · Cgm Clininet

CVE-2025-58402 · Publicado 2026-03-02 · Atualizado 2026-03-09

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CGM CLININET (affected versions not specified)

Description The application utilizes direct, sequential object identifiers, specifically the MessageID parameter, without sufficient authorization controls. An attacker can potentially access messages and attachments belonging to other users by manipulating the MessageID parameter in a GET request. The vulnerability is an Insecure Direct Object Reference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2025-58402

Produtos afetados

Cgm Clininet

Referências · 10

• https://cert.pl/en/posts/2026/03/CVE-2025-10350 · Nota
• https://twitter.com/VulmonFeeds/status/2028463409142931905 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-58402 · Aviso do Fabricante
• https://t.me/cveNotify/154810 · Publicação no Telegram
• https://cgm.com/pol_pl/products/szpital/cgm-clininet.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-58402 · Nota de Segurança
• https://t.me/cveNotify/153714 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2028437079555010878 · Publicação no Twitter
• https://t.me/CVEtracker/46114 · Publicação no Telegram
• https://twitter.com/infoflowcloud/status/2028439210936402308 · Publicação no Twitter