Clininet
CVE-2025-58405
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.
AnalysisAI
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. [CVSS 6.1 MEDIUM]
Technical ContextAI
Classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames). Affects Clininet. The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client d
The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks.
The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such
Share
External POC / Exploit Code
Leaving vuln.today