CVE-2025-61959

Katalog CVE

CVSS 5.3 · Medium EPSS 0,27%

Kerentanan Generation of Error Message Containing Sensitive Information pada vertikalsystems hospital manager backend services. Skor CVSS 3.1 5.3 (Medium) menurut hq.dhs.gov.

Deskripsi (NVD)

Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode="Off"', which could have facilitated reconnaissance by unauthenticated attackers.

Rincian

Terbit di NVD

29 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber hq.dhs.gov
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01 mitigasi · advisory pihak ketiga · pemerintah AS
• https://www.vertikalsystems.com/en/products/pm/contact.php product