What happened
Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. This issue is fixed as of 2025-03-14.
Affected versions
Enterprise Health: RC202503 through before RC202503 2025-03-14 (custom); RC202409 through before RC202409 2025-03-14 (custom); RC202403 through before RC202403 2025-03-14 (custom); RC202309 through before RC202309 2025-03-14 (custom); RC202303 through before RC202303 2025-03-14 (custom) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.
Source timeline
CVE record published by NVDView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.