CVE-2021-4295 — MEDIUM (5.5)

Q: How severe is CVE-2021-4295?

CVE-2021-4295 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2021-4295?

Check the references section above for vendor advisories and patch information. Affected products include: Healthit Code-Validator-Api.

Vulnerability Description

A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Healthit	Code-Validator-Api	< 1.0.31

Related Weaknesses (CWE)

CWE-611

References

https://github.com/onc-healthit/code-validator-api/commit/fbd8ea121755a2d3d116b1PatchThird Party Advisory
https://github.com/onc-healthit/code-validator-api/pull/97Third Party Advisory
https://github.com/onc-healthit/code-validator-api/releases/tag/1.0.31Third Party Advisory
https://vuldb.com/?ctiid.217018Third Party Advisory
https://vuldb.com/?id.217018Third Party Advisory
https://github.com/onc-healthit/code-validator-api/commit/fbd8ea121755a2d3d116b1PatchThird Party Advisory
https://github.com/onc-healthit/code-validator-api/pull/97Third Party Advisory
https://github.com/onc-healthit/code-validator-api/releases/tag/1.0.31Third Party Advisory
https://vuldb.com/?ctiid.217018Third Party Advisory
https://vuldb.com/?id.217018Third Party Advisory

FAQ

What is CVE-2021-4295?

CVE-2021-4295 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sit...

How severe is CVE-2021-4295?

CVE-2021-4295 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-4295?

Check the references section above for vendor advisories and patch information. Affected products include: Healthit Code-Validator-Api.