CVE-2023-23637

IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modifyonto request to the ontology builder. This may allow attackers to steal Protected Health Information...

IMPatienT Cross-Site Scripting Vulnerabilities

IMPatienT is an integrated web application for digitizing, processing, and exploring multimodal patient data. A security vulnerability previously existed in IMPatienT version 1.5.2, which stemmed from the ability to perform stored cross-site scripting attacks on certain fields of PATCH /modifyont...

CVE-2023-23637: Improper Neutralization of Input During Web Page Generation

IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modifyonto request to the ontology builder. This may allow attackers to steal Protected Health Information...

CVE-2023-23637

CVE-2023-23637 affects IMPatienT before 1.5.2. It allows stored XSS via onmouseover in certain text fields within PATCH /modify_onto to the ontology builder, potentially leading to disclosure of Protected Health Information. CVSS v3.1 base score 7.6 (HIGH), vectors: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:...