CyberRota Analysis
AI-GeneratedPathling Server versions prior to 2.0.0 are vulnerable due to inadequate validation of the `oauthMetadataUrl` parameter in the bulk-submit operation, allowing an attacker to manipulate OAuth flows and potentially gain unauthorized access to sensitive data. This vulnerability poses a high risk to organizations using Pathling for health data analytics, particularly those handling sensitive clinical information. Health data analytics teams and security professionals should prioritize upgrading to version 2.0.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This is fixed in Pathling Server 2.0.0.