Description (CNA)
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CGM / CGM CLININET | affected 0 before 2025.MS3 |
CWE
CWE-1021
References
- https://cert.pl/en/posts/2026/03/CVE-2025-10350/
- https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html
ADP enrichment
No English description supplied.
No references supplied.