CVE-2019-12741 Cross-site Scripting in HAPI FHIR
Cross-site scripting in the HAPI FHIR testpage overlay module allows attackers to leak cookies via unsanitized HTTP parameters in a crafted URL.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-12741?
CVE-2019-12741 is a medium-severity cross-site scripting vulnerability in n/a, published on 5 Jun 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.)
Weakness: CWE-79
Which versions are affected by CVE-2019-12741?
2 open source packages ship an affected version, including ca.uhn.hapi.fhir:hapi-fhir-base. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ca.uhn.hapi.fhir:hapi-fhir-base Maven | All versions | 3.8.0 |
ca.uhn.hapi.fhir:hapi-fhir-base Maven | All versions | 3.8.0 |
Products include Fhir Hapi Fhir.
How do I fix CVE-2019-12741?
Upgrade ca.uhn.hapi.fhir:hapi-fhir-base to 3.8.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-12741 being exploited?
There is no known exploitation of CVE-2019-12741 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-52mh-p2m2-w625.