CVE-2015-4594

Critical

Published: 10/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

eClinicalWorks Population Health (CCMR) has a session fixation vulnerability. The application does not assign a new session ID during user authentication, allowing the use of an existing session ID.

Risk Assessment

An attacker could take control of a user's session, leading to unauthorized access to application data and functions. This could result in serious data security breaches.

Recommendation

It is recommended that the application assigns a new session ID after each user authentication. Additionally, user sessions should be monitored for suspicious activities.

Original NVD description (English source)

eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID.