CVE-2024-50589CWE-306

Unprotected FHIR API

High · published November 8, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
46.5
In the wild
Unconfirmed
What it is

An unauthenticated attacker with access to the local network of the

medical office can query an unprotected Fast Healthcare Interoperability

Resources (FHIR) API to get access to sensitive electronic health

records (EHR).

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00572 · 46.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2024-11-08T11:34Z
EPSS history
Timeline
  • 08 NOV 11:34Z
    Unprotected FHIR API
    cvelistv5