CVE-2021-40375 - CVE House
Back to Database
Status published Medium CVE-2021-40375

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the...

Vulnerability Description

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This response can be read in an intercepting proxy or by viewing the page source. Sensitive information returned in responses includes patient PII and medication records or history.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-40375

Credits & Attribution

No credits recorded in the NVD database.

References

More from apperta

View All →
CVE-2021-40374
A stored cross-site scripting (XSS) vulnerability was identified in Apperta...
Medium 5.4

Affected Vendor

Affected Software

openeyes
Vulnerable Versions:
3.5.1

Timeline

Official Publish: April 6th, 2022
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.