CVE-2025-35032
LowCVSS 3.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact depends on how files are accessed. This issue is fixed as of 2025-04-08.
Risk Assessment
An authenticated attacker can upload malicious files, potentially leading to code execution or data exposure depending on how files are accessed. Organizations using Enterprise Health are at risk.
Recommendation
Ensure the system is updated to the version containing the fix from 2025-04-08. If not, restrict file uploads to necessary types.
Other vulnerabilities in Enterprise Health
See all- CVE-2025-35034Medium
Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthenticated attacker can craft a URL that can execute arbitrary JavaScript in the victim's browser. This issue is fixed as of 2025-03-14.
- CVE-2025-35031Low
Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, allowing impersonation of that user. This issue is fixed as of 2025-04-08.
Original NVD description (English source)
Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS