CVE-2015-6538

Published: Dec 27, 2015Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.

Affected (3)

Products: Ephiphanyheathdata: Cardio Server

Ephiphanyheathdata

1 product

Cardio Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Ephiphanyheathdata Cardio Server	Version 3.3
Ephiphanyheathdata Cardio Server	Version 4.0
Ephiphanyheathdata Cardio Server	Version 4.1

References (4)

http://www.epiphanyhealthdata.com/blog/certresponse

Source: cve@mitre.org

Vendor Advisory

https://www.kb.cert.org/vuls/id/630239

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.epiphanyhealthdata.com/blog/certresponse

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.kb.cert.org/vuls/id/630239

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.