CVE-2025-35034
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthenticated attacker can craft a URL that can execute arbitrary JavaScript in the victim's browser. This issue is fixed as of 2025-03-14.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser context, potentially leading to session theft, credential theft, or other sensitive information disclosure.
Recommendation
Ensure Enterprise Health is updated to the version containing the fix from 2025-03-14. Implement input validation and encoding mechanisms.
Other vulnerabilities in Enterprise Health
See all- CVE-2025-35032Low
Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact depends on how files are accessed. This issue is fixed as of 2025-04-08.
- CVE-2025-35031Low
Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, allowing impersonation of that user. This issue is fixed as of 2025-04-08.
Original NVD description (English source)
Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthenticated attacker can craft a URL that can execute arbitrary JavaScript in the victim's browser. This issue is fixed as of 2025-03-14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS