CVE-2014-5452 CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document con...
MediumCVSS 4.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hl7 c-cda | <= 1.1 | No fix listed |
References
- gforge.hl7.org patch
- motorcycleguy.blogspot.com patch
- smartplatforms.org exploit
- www-01.ibm.com
- 69633 vdb-entry
- 1033511 vdb-entry