VulnerabilityModified
CVE-2016-6272
XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp.
HIGH 7.5EPSS 20.9%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 20.9%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp. NOTE: this was originally reported as a SQL injection vulnerability, but this may be inaccurate.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 20.88% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-91
- Affected
- epic/mychart
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/146418/EPIC-MyChart-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/44098/Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/146418/EPIC-MyChart-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/44098/Exploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.