PT-2023-21736 · Unknown · Hl7 Fhir Core Libraries

Jlleitschuh · Published 2023-03-10 · Updated 2023-12-15 · CVE-2023-28465

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HL7 FHIR Core Libraries versions prior to 5.6.106

Description The issue allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. This is due to an incomplete fix for a previous issue.

Recommendations For versions prior to 5.6.106, update to version 5.6.106 or later to resolve the issue. As a temporary workaround, consider restricting access to the package-decompression feature to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-28465

GHSA-9654-PR4F-GH6M

Affected Products

Hl7 Fhir Core Libraries

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2023-28465 · Security Note
• https://osv.dev/vulnerability/GHSA-9654-pr4f-gh6m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28465 · Vendor Advisory
• https://github.com/hapifhir/org.hl7.fhir.core · Note
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-9654-pr4f-gh6m · Note
• https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/5.6.106 · Note
• https://github.com/hapifhir/org.hl7.fhir.core/blob/b0daf666725fa14476d147522155af1e81922aac/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/terminologies/TerminologyCacheManager.java#L99-L105 · Note
• https://github.com/hapifhir/org.hl7.fhir.core/pull/1162 · Note
• https://smilecdr.com/our-blog/statement-on-cve-2023-24057-smile-digital-health · Note
• https://twitter.com/CVEnew/status/1734626780756259091 · Twitter Post
• https://github.com/advisories/GHSA-9654-pr4f-gh6m · Note
• https://smilecdr.com/our-blog · Note