Clininet
CVE-2025-58406
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.
AnalysisAI
The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls. [CVSS 4.3 MEDIUM]
Technical ContextAI
Classified as CWE-693 (Protection Mechanism Failure). Affects Clininet. The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client d
The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks.
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today