CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests

published May 10, 2021

CVSS
—
EPSS
2%
Percentile
75.4
In the wild
Unconfirmed
What it is

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01587 · 75.4th percentile
Published
2021-05-10T20:43Z
EPSS history
Timeline
  • 10 MAY 20:43Z
    JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests
    cvelistv5