PT-2022-24826 · Unknown · Fhir-Works-On-Aws-Authz-Smart

Published 2022-09-21 · Updated 2022-09-26 · CVE-2022-39230

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions fhir-works-on-aws-authz-smart versions 3.1.1 through 3.1.2

Description The issue allows a client of the API to retrieve more information than the client's OAuth scope permits when making "search-type" requests. However, this issue would not allow a client to retrieve information about individuals other than those the client was already authorized to access.

Recommendations For fhir-works-on-aws-authz-smart versions 3.1.1 and 3.1.2, upgrade to version 3.1.3 or higher immediately. There is no workaround for this issue, so upgrading to the latest version is the recommended course of action.

Exploit

Fix

Improper Preservation of Permissions

Information Disclosure

Weakness Enumeration

CWE-281

CWE-200

Related Identifiers

CVE-2022-39230

GHSA-VV7X-7W4M-Q72F

Affected Products

Fhir-Works-On-Aws-Authz-Smart

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39230.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39230 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39230 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vv7x-7w4m-q72f · Vendor Advisory
• https://github.com/awslabs/fhir-works-on-aws-authz-smart · Note
• https://github.com/awslabs/fhir-works-on-aws-authz-smart/commit/203bbc0dd17de748c36b33c68b866ed2dfd613d3 · Note
• https://github.com/awslabs/fhir-works-on-aws-authz-smart/security/advisories/GHSA-vv7x-7w4m-q72f · Note
• https://t.me/cibsecurity/50302 · Telegram Post