Hapifhir
Monthly
Stored cross-site scripting in HAPI FHIR's scan command allows an attacker who controls an Implementation Guide or FHIR profile to inject arbitrary JavaScript into generated scan.html reports. All versions of org.hl7.fhir.core, ca.uhn.hapi.fhir:org.hl7.fhir.validation, and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli prior to 6.9.11 are affected. When a developer or CI pipeline scans the malicious IG and subsequently opens or publishes the resulting HTML report, the injected payload executes in the viewer's browser context - no public exploit or CISA KEV listing exists at time of analysis, but the fix commit and advisory are public.
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in HAPI FHIR's scan command allows an attacker who controls an Implementation Guide or FHIR profile to inject arbitrary JavaScript into generated scan.html reports. All versions of org.hl7.fhir.core, ca.uhn.hapi.fhir:org.hl7.fhir.validation, and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli prior to 6.9.11 are affected. When a developer or CI pipeline scans the malicious IG and subsequently opens or publishes the resulting HTML report, the injected payload executes in the viewer's browser context - no public exploit or CISA KEV listing exists at time of analysis, but the fix commit and advisory are public.
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.