PT-2022-19923
CVE-2022-29939
·
تاريخ النشر
2022-05-05
·
تاريخ التحديث
2022-05-12
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
LibreHealth EHR version 2.0.0
Description
The issue arises from the lack of sanitization of the GET parameters
debug and InsId in the interfacebillingsl eob process.php file, leading to multiple cross-site scripting (XSS) vulnerabilities.Recommendations
For LibreHealth EHR version 2.0.0, consider disabling access to the interfacebillingsl eob process.php file until a patch is available, or restrict the use of the
debug and InsId parameters to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.قابلية الاستغلال
استغلال
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾