IMPatienT 跨站脚本漏洞

IMPatienT is an integrated web application for digitizing, processing, and exploring multimodal patient data. A security vulnerability previously existed in IMPatienT version 1.5.2, which stemmed from the ability to perform stored cross-site scripting attacks on certain fields of PATCH /modifyont...

CVE-2023-23637

CVE-2023-23637 affects IMPatienT before 1.5.2. It allows stored XSS via onmouseover in certain text fields within PATCH /modify_onto to the ontology builder, potentially leading to disclosure of Protected Health Information. CVSS v3.1 base score 7.6 (HIGH), vectors: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:...