CVE-2022-39230 - CVE House
Back to Database
Status published Medium CVE-2022-39230

Security issue in fhir-works-on-aws-authz-smart

Vulnerability Description

fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 are subject to Exposure of Sensitive Information to an Unauthorized Actor. This issue allows a client of the API to retrieve more information than the client’s OAuth scope permits when making “search-type” requests. This issue would not allow a client to retrieve information about individuals other than those the client was already authorized to access. Users of fhir-works-on-aws-authz-smart 3.1.1 or 3.1.2 should upgrade to version 3.1.3 or higher immediately. Versions 3.1.0 and below are unaffected. There is no workaround for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39230

Credits & Attribution

No credits recorded in the NVD database.

References

More from awslabs

View All →
CVE-2024-37293
aws-deployment-framework's potential risk can lead to privilege escalation
High 7.6
CVE-2023-51386
Sandbox Accounts for Events vulnerable to privilege escalation to read running events data
High 7.8
CVE-2023-50928
sandbox-accounts-for-events security misconfiguration leads to budget exceed
High 7.1
CVE-2023-36467
AWS data.all vulnerable to RCE through user injection of Python Commands
High 8
CVE-2023-30610
AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending
Medium 5.5

Affected Vendor

Affected Software

fhir-works-on-aws-authz-smart
Vulnerable Versions:
> 3.1.0, < 3.1.3

Timeline

Official Publish: September 23rd, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration