CVE-2024-50589

Published: Nov 8, 2024Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An unauthenticated attacker with access to the local network of the medical office can query an unprotected Fast Healthcare Interoperability Resources (FHIR) API to get access to sensitive electronic health records (EHR).

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (3)

https://hasomed.de/produkte/elefant/

Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

https://r.sec-consult.com/hasomed

Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

http://seclists.org/fulldisclosure/2024/Nov/3

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.