漏洞标题
N/A
漏洞描述信息
一名安全研究员发现了 McKesson Medical Imaging Company 所维护的Conserus Image Repository archive solution版本2.1.1.105中的XML外部实体(XXE)漏洞。一个未验证的用户向漏洞服务提交一个修改后的HTTP SOAP请求，允许访问本地文件系统上的任意文件，并将应用程序服务的用户名哈希密码发送给远程攻击者。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
A security researcher found an XML External Entity (XXE) vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 by McKesson Medical Imaging Company, which is now a Change Healthcare company. An unauthenticated user supplying a modified HTTP SOAP request to the vulnerable service allows for arbitrary file read access to the local file system as well as the transmittal of the application service's account hashed credentials to a remote attacker.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Change Healthcare Conserus Image Repository archive solution 安全漏洞
漏洞描述信息
Change Healthcare Conserus Image Repository archive solution是美国Change Healthcare公司的一套医疗诊断影像存储解决方案。 Change Healthcare Conserus Image Repository archive solution 2.1.1.105版本中存在XML外部实体注入漏洞。远程攻击者可通过发送已修改的HTTP SOAP请求利用该漏洞读取本地文件系统上的任意文件，获取应用程序服务的账户散列证书。
CVSS信息
N/A
漏洞类别
授权问题