9.9

CVE-2025-35032

Medical Informatics Engineering Enterprise Health arbitrary file upload

Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mieweb ≫ Enterprise Health Version rc202303
Mieweb ≫ Enterprise Health Version rc202309
Mieweb ≫ Enterprise Health Version rc202403
Mieweb ≫ Enterprise Health Version rc202409
Mieweb ≫ Enterprise Health Version rc202503
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.145
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
cisa-cg 6.2 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cisa-cg 3.4 1.7 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-35032
Third Party Advisory