CVE-2015-4593
HighSummary
eClinicalWorks Population Health (CCMR) has a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp that allows remote attackers to hijack the authentication of content administrators. This could lead to the creation, modification, and deletion of users, appointments, and employees.
Risk Assessment
This vulnerability poses a significant risk to the organization, allowing attackers to manipulate user data and gain access to sensitive information.
Recommendation
It is recommended to implement appropriate CSRF protections and update the software to the latest version to minimize the risk of attacks.
Other vulnerabilities in eClinicalWorks Population Health (CCMR)
See all- CVE-2015-4592High
eClinicalWorks Population Health (CCMR) has an SQL injection vulnerability in portalUserService.jsp, allowing remote authenticated users to inject arbitrary malicious database commands as part of user input.
- CVE-2015-4594Critical
eClinicalWorks Population Health (CCMR) has a session fixation vulnerability. The application does not assign a new session ID during user authentication, allowing the use of an existing session ID.
Original NVD description (English source)
eClinicalWorks Population Health (CCMR) suffers from a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp which allows remote attackers to hijack the authentication of content administrators for requests that could lead to the creation, modification and deletion of users, appointments and employees.