Medium severity · published Sep 30, 2022
CVE-2022-37461
Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input…
6.1
CVSS
1.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the (2) groupID, (3) offset, or (4) limit parameter to an Administrative Panel (Group and Users) page. There is a risk of an attacker retrieving patient information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MV
Medical Vitrea View · Canon
7.0 before 7.7.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-37461
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-37461
Exploit
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=30693
Vendor Advisory
https://www.vitalimages.com/customer-success-support-program/vital-images-software-security-updates/
Product
https://www.vitalimages.com/vitrea-vision/vitrea-view/