Clininet
CVE-2025-58402
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users.
AnalysisAI
The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users. [CVSS 7.5 HIGH]
Technical ContextAI
Classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Affects Clininet. The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client d
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security
The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today