CVE-2025-27955
CVE-2025-27955
In short
After logging out of Clinical Collaboration Platform 12.2.1.5, the session token stays active and can be reused by attackers to access sensitive patient data or run malicious code. This happens because the logout function doesn't properly invalidate the token.
Technical detail
The platform fails to invalidate session tokens upon logout (CWE-1259), allowing authenticated attackers to reuse valid tokens post-logout to access protected resources and potentially execute arbitrary code. This requires knowledge of a valid token but enables information disclosure and code execution without re-authentication.
Summary generated and translated by AI from the official description.
Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information and execute arbitrary code.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
n/a · n/aWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →