CVE-2015-4594
CriticalSummary
eClinicalWorks Population Health (CCMR) has a session fixation vulnerability. The application does not assign a new session ID during user authentication, allowing the use of an existing session ID.
Risk Assessment
An attacker could take control of a user's session, leading to unauthorized access to application data and functions. This could result in serious data security breaches.
Recommendation
It is recommended that the application assigns a new session ID after each user authentication. Additionally, user sessions should be monitored for suspicious activities.
Other vulnerabilities in eClinicalWorks Population Health (CCMR)
See all- CVE-2015-4593High
eClinicalWorks Population Health (CCMR) has a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp that allows remote attackers to hijack the authentication of content administrators. This could lead to the creation, modification, and deletion of users, appointments, and employees.
- CVE-2015-4592High
eClinicalWorks Population Health (CCMR) has an SQL injection vulnerability in portalUserService.jsp, allowing remote authenticated users to inject arbitrary malicious database commands as part of user input.
Original NVD description (English source)
eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID.