CVE-2025-35031
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, allowing impersonation of that user. This issue is fixed as of 2025-04-08.
Risk Assessment
If an attacker convinces a user to share debug output, they can hijack the user's session and act on their behalf. This could lead to unauthorized access to medical and other protected data.
Recommendation
Ensure the system is updated to the version containing the fix from 2025-04-08. Instruct users not to share debug output with third parties.
Other vulnerabilities in Enterprise Health
See all- CVE-2025-35034Medium
Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthenticated attacker can craft a URL that can execute arbitrary JavaScript in the victim's browser. This issue is fixed as of 2025-03-14.
- CVE-2025-35032Low
Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact depends on how files are accessed. This issue is fixed as of 2025-04-08.
Original NVD description (English source)
Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of 2025-04-08.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS