4.7
CVE-2025-15581
- EPSS 0.41%
- Veröffentlicht 18.02.2026 22:59:55
- Zuletzt bearbeitet 15.04.2026 00:35:42
- Quelle ab69c47f-b95e-4bf2-b2d9-4b1fd1
- CVE-Watchlists
- Unerledigt
Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerorthanc-server
≫
Produkt
orthanc
Default Statusunaffected
Version <=
1.12.9
Version
0
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.41% | 0.324 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4a | 4.7 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
https://projectblack.io/blog/orthanc-1-12-9-user-impersonation/#exploitation
https://discourse.orthanc-server.org/t/orthanc-1-12-10/6326
https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=252
https://lists.debian.org/debian-lts-announce/2026/02/msg00033.html