MdAlAmin-aol Own Health Record logout.php cross-site request forgery
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 0.4-alpha is able to address this issue. The patch is named 58b413aa40820b49070782c786c526850ab7748f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249191.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MdAlAmin-aol | Own Health Record | 0.1-alpha; 0.2-alpha; 0.3-alpha; 0.3.1-alpha | — | No fix listed | CNA |
- Own Health Record VendorMdAlAmin-aol Affected 0.1-alpha; 0.2-alpha; 0.3-alpha; 0.3.1-alpha Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-25096
- 2026-10-03 Alias added: GHSA-67hq-4mrx-r888
References
Sources
- CVE-2018-25096 · CVE Program
- CVE-2018-25096 · NVD
- FIRST EPSS
- GHSA-67hq-4mrx-r888 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences