Information Disclosure Vulnerability in HL7 C-CDA by HL7

CVE-2014-3862

What is CVE-2014-3862?

The CDA.xsl file in HL7 C-CDA versions 1.1 and earlier is susceptible to a vulnerability that enables remote attackers to leverage crafted reference elements. This manipulation results in the generation of an IMG element whose SRC attribute may contain arbitrary URLs, potentially leading to the exposure of sensitive information through Referer logs. Attackers can exploit this flaw to gain insight into URLs that should remain confidential, thereby posing a significant risk to data privacy.

References