CVEvulnerability

CVE-2015-6538

9.8 CRITICAL Published 2015-12-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-12-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.

Affected configurations

• ephiphanyheathdata cardio server 3.3 • ephiphanyheathdata cardio server 4.0 • ephiphanyheathdata cardio server 4.1

References