CVE-2025-54459

Katalog CVE

CVSS 7.5 · High EPSS 0,42%

Kerentanan Exposure of Sensitive System Information to an Unauthorized Control Sphere pada vertikalsystems hospital manager backend services. Skor CVSS 3.1 7.5 (High) menurut hq.dhs.gov.

Deskripsi (NVD)

Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths.

Rincian

Terbit di NVD

29 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber hq.dhs.gov
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01 mitigasi · advisory pihak ketiga · pemerintah AS