CVE-2025-30064 — Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key

CVE-2025-30064

Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key PUBLISHED

Description (CNA)

An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to generate a session for any user.

Affected (CNA)

Vendor / product	Versions
CGM / CGM CLININET	affected 0 before 2025.MS2

CWE

CWE-912, CWE-347

References

https://cert.pl/en/posts/2025/08/CVE-2025-2313/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.