XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack
    involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and
    other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This
    module is not generally used in production systems so the attack surface is expected to be low, but
    affected systems are recommended to upgrade immediately.) (CVE-2019-12741)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack
    involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and
    other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This
    module is not generally used in production systems so the attack surface is expected to be low, but
    affected systems are recommended to upgrade immediately.) (CVE-2019-12741)

ID	Name	Product	Family	Type	Severity
422663	SCA: security update for ca.uhn.hapi.fhir:hapi-fhir-base (GHSA-52mh-p2m2-w625)	Tenable Cloud Security	SCA Checks	Local	medium
422663	SCA: security update for ca.uhn.hapi.fhir:hapi-fhir-base (GHSA-52mh-p2m2-w625)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
405860	Alpine: nomad: security update to 0.9.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
405860	Alpine: nomad: security update to 0.9.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2019-12741

medium

Tenable Plugins

medium

medium

medium

medium