by Kastro
Paper/Archive/CVE-2025-35032

CVE-2025-35032

Medical Informatics Engineering Enterprise Health — Medical Informatics Engineering Enterprise Health arbitrary file upload

EPSS 0.3%CVSS 9.9
critical.is priorityof 100
33
CVSS 9.9 (NVD)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 16.8.168 × 203.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.

Affected

ProductAffectedFixed inSource
Enterprise Health< 2025-04-082025-04-08CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
cisa-cg (CNA)6.2CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
cisa-cg (CNA)3.4CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refraw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.jsonrefcve.org/CVERecord?id=CVE-2025-35032