XML Handling Flaw in HL7 C-CDA by Health Level Seven International

CVE-2014-5452

What is CVE-2014-5452?

The CDA.xsl file in HL7 C-CDA 1.1 and earlier fails to validate C-CDA documents correctly, allowing remote attackers to exploit crafted XML attributes. This vulnerability opens the door to Cross-Site Scripting (XSS) attacks, where malicious documents containing tables could be improperly processed during unrestricted xsl:copy operations. Such an oversight in input validation poses a significant risk in environments dependent on accurate healthcare data representation and exchange, making it crucial for organizations to implement adequate security measures.

References