Hospital Manager Backend Services
Monthly
Hospital Manager Backend Services prior to September 19, 2025 discloses verbose ASP.NET error pages to unauthenticated remote attackers when configured with customErrors mode='Off', enabling reconnaissance via framework/version metadata, stack traces, and internal paths. This low-to-moderate CWE-209 issue was remediated prior to that date, and no public exploit has been identified at time of analysis.
Unauthenticated remote access to the exposed ASP.NET tracing endpoint /trace.axd in Vertikal Systems' Hospital Manager Backend Services (versions prior to the September 19, 2025 fix) discloses live request traces containing sensitive data such as session identifiers, authorization headers, server variables, internal file paths, and request metadata. The endpoint requires no credentials, user interaction, or special tooling - a single HTTP request (CVSS 4.0 base 8.7, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is sufficient - with confidentiality impact rated High and no integrity or availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was provided; risk hinges primarily on whether the backend service is network-reachable and whether tracing remains enabled. This is a genuine, high-confidence information-disclosure issue rather than a theoretical high-CVSS inflation, and the fact that exploitable data is returned from production traffic makes post-exposure credential and session rotation important.
Hospital Manager Backend Services prior to September 19, 2025 discloses verbose ASP.NET error pages to unauthenticated remote attackers when configured with customErrors mode='Off', enabling reconnaissance via framework/version metadata, stack traces, and internal paths. This low-to-moderate CWE-209 issue was remediated prior to that date, and no public exploit has been identified at time of analysis.
Unauthenticated remote access to the exposed ASP.NET tracing endpoint /trace.axd in Vertikal Systems' Hospital Manager Backend Services (versions prior to the September 19, 2025 fix) discloses live request traces containing sensitive data such as session identifiers, authorization headers, server variables, internal file paths, and request metadata. The endpoint requires no credentials, user interaction, or special tooling - a single HTTP request (CVSS 4.0 base 8.7, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is sufficient - with confidentiality impact rated High and no integrity or availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was provided; risk hinges primarily on whether the backend service is network-reachable and whether tracing remains enabled. This is a genuine, high-confidence information-disclosure issue rather than a theoretical high-CVSS inflation, and the fact that exploitable data is returned from production traffic makes post-exposure credential and session rotation important.