CyberSecBulletin

FHIR vulnerabilities

We track 2 vulnerabilities in FHIR products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on December 13, 2024.

2vulnerabilities
1critical
1high
0exploited
9.2average CVSS score

Latest FHIR vulnerabilities

  • 8.6 High severity

    Ucum-java: Improper Restriction of XML External Entity Reference

    CVE-2024-55887FHIR

    Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing da

  • 9.8 Critical severity

    hapi_fhir: Improper Restriction of XML External Entity Reference

    CVE-2024-51132FHIREPSS 1.9%

    An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.