CVE-2021-32053

2021-05-1020:43:45

mitre

raw.githubusercontent.com

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

47.3%

JSON

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.