Vulnerabilidades em CGM
36 resultadosAnálise Vexday
A CGM possui 25 vulnerabilidades catalogadas, com 11 delas classificadas como críticas, predominantemente relacionadas a falhas de autenticação (CWE-306). Não há evidência de exploração ativa em campo e nenhuma divulgação recente, sugerindo que o risco está contido na base instalada existente. Recomenda-se priorizar a remediação das falhas de autenticação em ambientes críticos.
CVE-2025-30057CRITICALAuthenticated RCE with uhcapache privileges in ConvertToPDFEPSS 0.7%CVE-2025-30044CRITICALRCE on uhcapache user permissionsEPSS 0.6%CVE-2025-58403MEDIUMReflected Cross-Site Scripting (XSS) in CGM CLININETEPSS 0.5%CVE-2025-30047CRITICALRemote Code Execution via Java Deserialization in CGM CLININETEPSS 0.4%CVE-2025-30053MEDIUMMissing Authentication in CGM CLININETEPSS 0.4%CVE-2025-30052HIGHAuthentication Bypass via IP Spoofing in CGM CLININET rsyncdEPSS 0.3%CVE-2025-30035CRITICALLack of API authentication allowing session generation for any userEPSS 0.3%CVE-2025-30046CRITICALRemote Code Execution in CGM CLININETEPSS 0.3%CVE-2025-2313CRITICALRCE via Print.pl in uhcPrintServerPrintEPSS 0.2%CVE-2025-58402HIGHInsecure Direct Object Reference Message IDEPSS 0.2%CVE-2025-30056CRITICALCalling system commands via RunCommandEPSS 0.2%CVE-2025-30055CRITICALConditional RCE via the "system" functionEPSS 0.2%CVE-2025-30050CRITICALRemote Code Execution in CGM CLININETEPSS 0.2%CVE-2025-30061MEDIUMSQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameterEPSS 0.2%CVE-2025-30060MEDIUMSQL injection in ReturnUserUnitsXML.pl via the UserID parameterEPSS 0.2%CVE-2025-30059MEDIUMAuthenticated SQL injection in PrepareCDExportJSON.plEPSS 0.2%CVE-2025-30058MEDIUMSQL injection in getPatientIdentifier function of PatientService.plEPSS 0.2%CVE-2025-58406MEDIUMLack of HTTP Response HeadersEPSS 0.2%CVE-2025-30049HIGHUse of Unsalted MD5 Password Hashes in CGM CLININETEPSS 0.2%CVE-2025-30043HIGHMissing Authentication in CGM CLININETEPSS 0.2%