CVE-2020-24301: Improper Neutralization of Input During Web Page Generation

Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testin...

PT-2020-15675

Name of the Vulnerable Software and Affected Versions HAPI FHIR Testpage Overlay versions 5.0.0 and below Description The issue allows users to exploit an XSS vulnerability using a specially crafted URL, enabling arbitrary JavaScript to be executed in the user's browser. This vulnerability is...

Cross-site Scripting

Users of the HAPI FHIR Testpage Overlay can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testing and not believ...

XML External Entity (XXE)

jamesagnew/hapi-fhir is vulnerable to XML External Entity XXE attacks. This attack occurs because the function FhirInstanceValidator accepts and processes XML input containing a reference to an external entity, allowing a remote attacker to access local or remote files and service conditions...

Information Disclosure

hapi-fhir-server is vulnerable to information disclosure. When using the Consent Service and denying a resource via the Will See Resource method, the resource ID and version were still returned to the user...

Cross-site Scripting in HAPI FHIR

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

GHSA-52MH-P2M2-W625 Cross-site Scripting in HAPI FHIR

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

ca.uhn.hapi.fhir:hapi-fhir-android (2.0), ca.uhn.hapi.fhir:hapi-fhir-client-okhttp (2.0) +25 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (2.0)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 2.0 - ca.uhn.hapi.fhir:hapi-fhir-client-okhttp 2.0 -...

ca.uhn.hapi.fhir:hapi-fhir-android (2.4), ca.uhn.hapi.fhir:hapi-fhir-client-okhttp (2.4) +76 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (2.4)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 2.4 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 2.4 - ca.uhn.hapi.fhir:hapi-fhir-client-okhttp 2.4 -...

ca.uhn.hapi.fhir:hapi-tinder-plugin (0.1) potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.1)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-tinder-plugin 0.1 Source cves: CVE-2019-12741 Source advisory:...

ca.uhn.hapi.fhir:hapi-tinder-plugin (0.3) potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.3)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-tinder-plugin 0.3 Source cves: CVE-2019-12741 Source advisory:...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (0.4), ca.uhn.hapi.fhir:hapi-tinder-plugin (0.4) potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.4)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.4 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay 0.4 - ca.uhn.hapi.fhir:hapi-tinder-plugin 0.4 Source...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (0.5), ca.uhn.hapi.fhir:hapi-tinder-plugin (0.5) potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.5)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.5 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay 0.5 - ca.uhn.hapi.fhir:hapi-tinder-plugin 0.5 Source...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (0.6), ca.uhn.hapi.fhir:hapi-tinder-plugin (0.6) +50 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.6)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.6 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay 0.6 - ca.uhn.hapi.fhir:hapi-tinder-plugin 0.6 -...

ca.uhn.hapi.example:restful-server-example (0.7), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (0.7) +1 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.7)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.7 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.example:restful-server-example 0.7 - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay 0.7 -...

org.carewebframework:org.carewebframework.fhir.client (1.2), org.carewebframework:org.carewebframework.fhir.core (1.2) +2 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (1.2)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - org.carewebframework:org.carewebframework.fhir.client 1.2 -...

ca.uhn.hapi.fhir:hapi-fhir-android (1.5), ca.uhn.hapi.fhir:hapi-fhir-jaxrsserver-base (1.5) +14 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (1.5)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 1.5 - ca.uhn.hapi.fhir:hapi-fhir-jaxrsserver-base 1.5 -...

ca.uhn.hapi.fhir:hapi-fhir-android (2.2), ca.uhn.hapi.fhir:hapi-fhir-client-okhttp (2.2) +12 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (2.2)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 2.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 2.2 - ca.uhn.hapi.fhir:hapi-fhir-client-okhttp 2.2 -...

ca.uhn.hapi.fhir.karaf:hapi-fhir (>=3.3.0, <=3.7.0), ca.uhn.hapi.fhir:hapi-fhir-android (>=3.0.0, <=3.7.0) +128 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (>=3.0.0, <=3.7.0)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version =3.0.0, =3.3.0, =3.0.0, =3.4.0, =3.0.0, =3.0.0, =3.0.0, =3.6.0, =3.0.0, =3.0.0, =3.5.0, =3.3.0, =3.0.0, =3.7.0 and more Source cves: CVE-2019-12741 Source advisory: OSV:GHSA-52MH-P2M2-W625...

ca.uhn.hapi.fhir.karaf:hapi-fhir (>=3.3.0, <=3.7.0), ca.uhn.hapi.fhir:hapi-fhir-android (>=3.0.0, <=3.7.0) +128 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (>=3.0.0, <=3.7.0)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version =3.0.0, =3.3.0, =3.0.0, =3.4.0, =3.0.0, =3.0.0, =3.0.0, =3.6.0, =3.0.0, =3.0.0, =3.5.0, =3.3.0, =3.0.0, =3.7.0 and more Source cves: CVE-2019-12741 Source advisory: GHSA-52MH-P2M2-W625...