CVE-2024-50589
Unprotected FHIR API
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
An unauthenticated attacker with access to the local network of the
medical office can query an unprotected Fast Healthcare Interoperability
Resources (FHIR) API to get access to sensitive electronic health
records (EHR).
Un atacante no autenticado con acceso a la red local del consultorio médico puede consultar una API de recursos de interoperabilidad rápida de atención médica (FHIR) desprotegida para obtener acceso a registros médicos electrónicos (EHR) confidenciales.
HASOMED Elefant versions prior to 24.04.00 and Elefant Software Updater versions prior to 1.4.2.1811 suffer from having an unprotected exposed firebird database, unprotected FHIR API, multiple local privilege escalation, and hardcoded service password vulnerabilities.
*Credits:
Tobias Niemann, SEC Consult Vulnerability Lab, Daniel Hirschberger, SEC Consult Vulnerability Lab, Florian Stuhlmann, SEC Consult Vulnerability Lab
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-10-25 CVE Reserved
- 2024-11-08 CVE Published
- 2024-11-08 CVE Updated
- 2024-11-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-306: Missing Authentication for Critical Function
CAPEC
- CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
References (2)
| URL | Tag | Source |
|---|---|---|
| https://r.sec-consult.com/hasomed | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://hasomed.de/produkte/elefant | 2024-11-08 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| - | - | - | - | - | ||||||