Description (CNA)
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CGM / CGM CLININET | affected 0 before 2025.MS4 |
CWE
CWE-306
References
- https://cert.pl/en/posts/2026/03/CVE-2025-10350/
- https://https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html
ADP enrichment
No English description supplied.
No references supplied.