Medical Informatics Engineering Enterprise Health arbitrary file upload
Priority LOW 27CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00253 16th percentileScored 2026-11-07
Fix Fixed Enterprise Health (Medical Informatics Engineering): 2025-04-08
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Medical Informatics Engineering | Enterprise Health | before 2025-04-08 | 2025-04-08 | Patch available | CNA |
- Enterprise Health VendorMedical Informatics Engineering Affected before 2025-04-08 Fixed in 2025-04-08 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mieweb:enterprise_health:rc202303:*:*:*:*:*:*:* | rc202303 | Vulnerable | Medical Informatics Engineering |
| cpe:2.3:a:mieweb:enterprise_health:rc202309:*:*:*:*:*:*:* | rc202309 | Vulnerable | Medical Informatics Engineering |
| cpe:2.3:a:mieweb:enterprise_health:rc202403:*:*:*:*:*:*:* | rc202403 | Vulnerable | Medical Informatics Engineering |
| cpe:2.3:a:mieweb:enterprise_health:rc202409:*:*:*:*:*:*:* | rc202409 | Vulnerable | Medical Informatics Engineering |
| cpe:2.3:a:mieweb:enterprise_health:rc202503:*:*:*:*:*:*:* | rc202503 | Vulnerable | Medical Informatics Engineering |
- cpe:2.3:a:mieweb:enterprise_health:rc202303:*:*:*:*:*:*:* Versions rc202303 Vulnerable ·Medical Informatics Engineering
- cpe:2.3:a:mieweb:enterprise_health:rc202309:*:*:*:*:*:*:* Versions rc202309 Vulnerable ·Medical Informatics Engineering
- cpe:2.3:a:mieweb:enterprise_health:rc202403:*:*:*:*:*:*:* Versions rc202403 Vulnerable ·Medical Informatics Engineering
- cpe:2.3:a:mieweb:enterprise_health:rc202409:*:*:*:*:*:*:* Versions rc202409 Vulnerable ·Medical Informatics Engineering
- cpe:2.3:a:mieweb:enterprise_health:rc202503:*:*:*:*:*:*:* Versions rc202503 Vulnerable ·Medical Informatics Engineering
Remediation
- Fix · CNA Enterprise Health (Medical Informatics Engineering) Fixed in 2025-04-08
Timeline
- 2026-10-02 Threatist record created from CVE-2025-35032
- 2026-10-03 Alias added: GHSA-cfj8-9637-66c4
More Medical Informatics Engineering Enterprise Health vulnerabilities
- TI-2025-24560 Medical Informatics Engineering Enterprise Health cross site request forgery CVSS 4.0HIGH 8.6
- TI-2025-24563 Medical Informatics Engineering Enterprise Health CSV injection CVSS 4.0MEDIUM 6.3
- TI-2025-24564 Medical Informatics Engineering Enterprise Health reflected cross site scripting via portlet_user_id CVSS 4.0MEDIUM 5.1
- TI-2025-24559 Medical Informatics Engineering Enterprise Health stored cross site scripting via Demographic Information page CVSS 4.0MEDIUM 4.8
- TI-2025-24561 Medical Informatics Engineering Enterprise Health includes session token in debug output CVSS 4.0MEDIUM 4.6
Sources
- CVE-2025-35032 · CVE Program
- CVE-2025-35032 · NVD
- FIRST EPSS
- GHSA-cfj8-9637-66c4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences