CVE-2014-3862 CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in it...
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hl7 c-cda | <= 1.1 | No fix listed |
References
- gforge.hl7.org patch
- motorcycleguy.blogspot.com patch
- smartplatforms.org exploit