{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "Medical Informatics Engineering Enterprise Health multiple vulnerabilities",
    "tracking": {
      "current_release_date": "2025-09-29T00:00:00Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.10.0"
        }
      },
      "id": "VA-25-272-01",
      "initial_release_date": "2025-09-29T00:00:00Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2025-09-29T00:00:00Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "Medical Informatics Engineering Enterprise Health is an OEHR (Occupational Electronic Health Record) platform. Enterprise Health contains multiple vulnerabilities that could allow an attacker to inject executable content, obtain session tokens, and upload arbitrary files.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "All instances of Medical Informatics Engineering Enterprise Health have been updated as of 2025-04-08. No further action is required to mitigate these vulnerabilities.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "United States",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json",
        "summary": "Vulnerability Advisory VA-25-272-01 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Medical Informatics Engineering",
        "branches": [
          {
            "category": "product_name",
            "name": "Enterprise Health",
            "branches": [
              {
                "category": "product_version_range",
                "name": ">=RC202503|<RC202503 2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health >=RC202503|<RC202503 2025-04-08",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=RC202409|<RC202409 2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health >=RC202409|<RC202409 2025-04-08",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=RC202403|<RC202403 2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health >=RC202403|<RC202403 2025-04-08",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=RC202309|<RC202309 2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health >=RC202309|<RC202309 2025-04-08",
                  "product_id": "CSAFPID-0004"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=RC202303|<RC202303 2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health >=RC202303|<RC202303 2025-04-08",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version",
                "name": "RC202503 2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health RC202503 2025-04-08",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version",
                "name": "RC202409 2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health RC202409 2025-04-08",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version",
                "name": "RC202403 2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health RC202403 2025-04-08",
                  "product_id": "CSAFPID-0008"
                }
              },
              {
                "category": "product_version",
                "name": "RC202309 2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health RC202309 2025-04-08",
                  "product_id": "CSAFPID-0009"
                }
              },
              {
                "category": "product_version",
                "name": "RC202303 2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health RC202303 2025-04-08",
                  "product_id": "CSAFPID-0010"
                }
              },
              {
                "category": "product_version_range",
                "name": "<2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health <2025-04-08",
                  "product_id": "CSAFPID-0011"
                }
              },
              {
                "category": "product_version",
                "name": "2025-04-08",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health 2025-04-08",
                  "product_id": "CSAFPID-0012"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=RC202503|<RC202503 2025-03-14",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health >=RC202503|<RC202503 2025-03-14",
                  "product_id": "CSAFPID-0013"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=RC202409|<RC202409 2025-03-14",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health >=RC202409|<RC202409 2025-03-14",
                  "product_id": "CSAFPID-0014"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=RC202403|<RC202403 2025-03-14",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health >=RC202403|<RC202403 2025-03-14",
                  "product_id": "CSAFPID-0015"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=RC202309|<RC202309 2025-03-14",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health >=RC202309|<RC202309 2025-03-14",
                  "product_id": "CSAFPID-0016"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=RC202303|<RC202303 2025-03-14",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health >=RC202303|<RC202303 2025-03-14",
                  "product_id": "CSAFPID-0017"
                }
              },
              {
                "category": "product_version",
                "name": "RC202503 2025-03-14",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health RC202503 2025-03-14",
                  "product_id": "CSAFPID-0018"
                }
              },
              {
                "category": "product_version",
                "name": "RC202409 2025-03-14",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health RC202409 2025-03-14",
                  "product_id": "CSAFPID-0019"
                }
              },
              {
                "category": "product_version",
                "name": "RC202403 2025-03-14",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health RC202403 2025-03-14",
                  "product_id": "CSAFPID-0020"
                }
              },
              {
                "category": "product_version",
                "name": "RC202309 2025-03-14",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health RC202309 2025-03-14",
                  "product_id": "CSAFPID-0021"
                }
              },
              {
                "category": "product_version",
                "name": "RC202303 2025-03-14",
                "product": {
                  "name": "Medical Informatics Engineering Enterprise Health RC202303 2025-03-14",
                  "product_id": "CSAFPID-0022"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-35029",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary content in the 'Demographic Information' page. This content will be rendered and executed when a victim accesses it. This issue is fixed as of 2025-03-14.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:P/2025-08-20T19:03:10Z/"
        }
      ],
      "title": "Medical Informatics Engineering Enterprise Health stored cross site scripting via Demographic Information page",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004"
        ],
        "fixed": [
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-35029"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "date": "2025-04-08T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "George Thompson"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Trevor LaPay"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Fernando Martinez"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Gary Huang"
          ]
        }
      ],
      "release_date": "2025-09-29T00:00:00Z"
    },
    {
      "cve": "CVE-2025-35030",
      "cwe": {
        "id": "CWE-352",
        "name": "Cross-Site Request Forgery (CSRF)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:T/2025-08-20T19:03:24Z/"
        }
      ],
      "title": "Medical Informatics Engineering Enterprise Health cross site request forgery",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005"
        ],
        "fixed": [
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009",
          "CSAFPID-0010"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-35030"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "date": "2025-04-08T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "George Thompson"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Trevor LaPay"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Fernando Martinez"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Gary Huang"
          ]
        }
      ],
      "release_date": "2025-09-29T00:00:00Z"
    },
    {
      "cve": "CVE-2025-35031",
      "cwe": {
        "id": "CWE-1295",
        "name": "Debug Messages Revealing Unnecessary Information"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of 2025-04-08.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:P/2025-08-20T19:03:36Z/"
        }
      ],
      "title": "Medical Informatics Engineering Enterprise Health includes session token in debug output",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ],
        "fixed": [
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-35031"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "date": "2025-04-08T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "George Thompson"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Trevor LaPay"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Fernando Martinez"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Gary Huang"
          ]
        }
      ],
      "release_date": "2025-09-29T00:00:00Z"
    },
    {
      "cve": "CVE-2025-35032",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:P/2025-08-20T19:04:18Z/"
        }
      ],
      "title": "Medical Informatics Engineering Enterprise Health arbitrary file upload",
      "product_status": {
        "known_affected": [
          "CSAFPID-0011"
        ],
        "fixed": [
          "CSAFPID-0012"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-35032"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0011"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0012"
          ],
          "date": "2025-04-08T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "George Thompson"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Trevor LaPay"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Fernando Martinez"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Gary Huang"
          ]
        }
      ],
      "release_date": "2025-09-29T00:00:00Z"
    },
    {
      "cve": "CVE-2025-35033",
      "cwe": {
        "id": "CWE-1236",
        "name": "Improper Neutralization of Formula Elements in a CSV File"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. This issue is fixed as of 2025-03-14.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:P/2025-08-20T19:04:42Z/"
        }
      ],
      "title": "Medical Informatics Engineering Enterprise Health CSV injection",
      "product_status": {
        "known_affected": [
          "CSAFPID-0013",
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017"
        ],
        "fixed": [
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-35033"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0013",
            "CSAFPID-0014",
            "CSAFPID-0015",
            "CSAFPID-0016",
            "CSAFPID-0017"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-03-14.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "date": "2025-03-14T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-03-14.",
          "product_ids": [
            "CSAFPID-0014"
          ],
          "date": "2025-03-14T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-03-14.",
          "product_ids": [
            "CSAFPID-0015"
          ],
          "date": "2025-03-14T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-03-14.",
          "product_ids": [
            "CSAFPID-0016"
          ],
          "date": "2025-03-14T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-03-14.",
          "product_ids": [
            "CSAFPID-0017"
          ],
          "date": "2025-03-14T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-03-14.",
          "product_ids": [
            "CSAFPID-0018"
          ],
          "date": "2025-03-14T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-03-14.",
          "product_ids": [
            "CSAFPID-0019"
          ],
          "date": "2025-03-14T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-03-14.",
          "product_ids": [
            "CSAFPID-0020"
          ],
          "date": "2025-03-14T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-03-14.",
          "product_ids": [
            "CSAFPID-0021"
          ],
          "date": "2025-03-14T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-03-14.",
          "product_ids": [
            "CSAFPID-0022"
          ],
          "date": "2025-03-14T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "George Thompson"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Trevor LaPay"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Fernando Martinez"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Gary Huang"
          ]
        }
      ],
      "release_date": "2025-09-29T00:00:00Z"
    },
    {
      "cve": "CVE-2025-35034",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthenticated attacker can craft a URL that can execute arbitrary JavaScript in the victim's browser. This issue is fixed as of 2025-03-14.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:P/2025-08-20T19:05:33Z/"
        }
      ],
      "title": "Medical Informatics Engineering Enterprise Health reflected cross site scripting via portlet_user_id",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004"
        ],
        "fixed": [
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-35034"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "date": "2025-04-08T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed on 2025-04-08.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "date": "2025-04-08T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "George Thompson"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Trevor LaPay"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Fernando Martinez"
          ]
        },
        {
          "organization": "Sandia National Laboratories",
          "names": [
            "Gary Huang"
          ]
        }
      ],
      "release_date": "2025-09-29T00:00:00Z"
    }
  ]
}