CVE-2021-40375

Katalog CVE

CVSS 6.5 · Medium EPSS 1,6%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada apperta openeyes. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This response can be read in an intercepting proxy or by viewing the page source. Sensitive information returned in responses includes patient PII and medication records or history.

Rincian

Terbit di NVD

6 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://openeyes.apperta.org/ product · advisory vendor
• https://github.com/DCKento/CVE-2021-40375 exploit · advisory pihak ketiga