Lucene search

[email protected]CVE-2023-28465

HistoryDec 12, 2023 - 5:15 p.m.

CVE-2023-28465

2023-12-1217:15:07

CWE-22

[email protected]

web.nvd.nist.gov

3142

hl7

fhir core libraries

cve-2023-28465

security vulnerability

file copy

directory traversal

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

26.2%

JSON

The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists because of an incomplete fix for CVE-2023-24057.

CPENameOperatorVersion
hapifhir:hl7_fhir_corehapifhir hl7 fhir corelt5.6.106
hapifhir:hl7_fhir_corehapifhir hl7 fhir coreeq5.3.12
hapifhir:hl7_fhir_corehapifhir hl7 fhir coreeq5.6.57
hapifhir:hl7_fhir_corehapifhir hl7 fhir coreeq5.6.92
hapifhir:hl7_fhir_corehapifhir hl7 fhir coreeq5.6.46
hapifhir:hl7_fhir_corehapifhir hl7 fhir coreeq5.3.11
hapifhir:hl7_fhir_corehapifhir hl7 fhir coreeq5.6.93
hapifhir:hl7_fhir_corehapifhir hl7 fhir coreeq5.1.8
hapifhir:hl7_fhir_corehapifhir hl7 fhir coreeq5.5.1
hapifhir:hl7_fhir_corehapifhir hl7 fhir coreeq5.6.91

CPE	Name	Operator	Version
hapifhir:hl7_fhir_core	hapifhir hl7 fhir core	lt	5.6.106
hapifhir:hl7_fhir_core	hapifhir hl7 fhir core	eq	5.3.12
hapifhir:hl7_fhir_core	hapifhir hl7 fhir core	eq	5.6.57
hapifhir:hl7_fhir_core	hapifhir hl7 fhir core	eq	5.6.92
hapifhir:hl7_fhir_core	hapifhir hl7 fhir core	eq	5.6.46
hapifhir:hl7_fhir_core	hapifhir hl7 fhir core	eq	5.3.11
hapifhir:hl7_fhir_core	hapifhir hl7 fhir core	eq	5.6.93
hapifhir:hl7_fhir_core	hapifhir hl7 fhir core	eq	5.1.8
hapifhir:hl7_fhir_core	hapifhir hl7 fhir core	eq	5.5.1
hapifhir:hl7_fhir_core	hapifhir hl7 fhir core	eq	5.6.91

Rows per page:

1-10 of 1871

References

github.com/advisories/GHSA-9654-pr4f-gh6m

www.smilecdr.com/our-blog

www.smilecdr.com/our-blog/statement-on-cve-2023-24057-smile-digital-health

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

26.2%

JSON

Related for CVE-2023-28465

prion2 veracode2 osv5 github2 gitlab6 cve1