What happened
Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08.
Affected versions
Enterprise Health: RC202503 through before RC202503 2025-04-08 (custom); RC202409 through before RC202409 2025-04-08 (custom); RC202403 through before RC202403 2025-04-08 (custom); RC202309 through before RC202309 2025-04-08 (custom); RC202303 through before RC202303 2025-04-08 (custom) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.