CVE-2025-35031mediumCWE-1295

CVE-2025-35031: medium-severity vulnerability in Medical Informatics Engineering Enterprise…

Medical Informatics Engineering Enterprise Health includes session token in debug output

Published · Updated

Follow this CVE+ Monitor Enterprise Health

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.6epss 0.1%
In short

Enterprise Health accidentally includes your session token in debug messages. If an attacker tricks you into sharing this debug output, they can pretend to be you and access your account.

Technical detail

CWE-1295 (Sensitive Information in Debug Output) vulnerability where session tokens are exposed in debug logs. An attacker can perform account takeover by social engineering a user to disclose debug output and then using the leaked token for unauthorized authentication. Fixed in versions released after 2025-04-08.

Summary generated and translated by AI from the official description.
Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of 2025-04-08.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Medical Informatics Engineering · Enterprise Health
Related CVEs — Medical Informatics Engineering Enterprise…

In the same product, most dangerous first.

CVE-2025-35034MEDIUMMedical Informatics Engineering Enterprise Health reflected cross site scripting via portlet_user_idEPSS 0.3%CVE-2025-35032MEDIUMMedical Informatics Engineering Enterprise Health arbitrary file uploadEPSS 0.3%CVE-2025-35033MEDIUMMedical Informatics Engineering Enterprise Health CSV injectionEPSS 0.2%CVE-2025-35029MEDIUMMedical Informatics Engineering Enterprise Health stored cross site scripting via Demographic Information pageEPSS 0.2%CVE-2025-35030HIGHMedical Informatics Engineering Enterprise Health cross site request forgeryEPSS 0.2%