CVE-2021-32053 - CVE House
Back to Database
Status published Medium CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user...

Vulnerability Description

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32053

Credits & Attribution

No credits recorded in the NVD database.

References

More from fhir

View All →
CVE-2019-12741
XSS exists in the HAPI FHIR testpage overlay module of...
Medium 6.1

Affected Vendor

Affected Software

hapi fhir
Vulnerable Versions:
0

Timeline

Official Publish: May 10th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.