VulnerabilityModified

CVE-2022-38765

An authenticated user is able to gain unauthorized access to imaging records by tampering with the vitrea-view/studies/search patientId parameter.

MEDIUM 6.5EPSS 0.48%

Does this matter?

Lower severity and a low EPSS score (0.48%). Track it; it rarely justifies an emergency change on its own.

Description

Canon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls. An authenticated user is able to gain unauthorized access to imaging records by tampering with the vitrea-view/studies/search patientId parameter.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.48% probability · 40th percentile
CISA KEV: Not listed
Weakness: CWE-639
Affected: canon/vitrea view
Source: cve@mitre.org

References

https://www.vitalimages.com/customer-success-support-program/vital-images-software-security-updates/Vendor Advisory
https://www.vitalimages.com/customer-success-support-program/vital-images-software-security-updates/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.