CVEvulnerability
CVE-2015-4593
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-01-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
eClinicalWorks Population Health (CCMR) suffers from a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp which allows remote attackers to hijack the authentication of content administrators for requests that could lead to the creation, modification and deletion of users, appointments and employees.
Affected configurations
• eclinicalworks population health
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://packetstormsecurity.com/files/135533/eClinicalWorks-Population-Health-CCMR-SQL-Injection-CSRF-XSS.html Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/537420/100/0/threaded Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/39402/ Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/135533/eClinicalWorks-Population-Health-CCMR-SQL-Injection-CSRF-XSS.html Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/537420/100/0/threaded Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/39402/ Exploit, Third Party Advisory, VDB Entry