CyberRota Analysis
AI-GeneratedThe vulnerability affects the HAPI FHIR implementation in Java prior to version 6.9.11, where the hidden scan command improperly concatenates user-controlled input into an HTML report without adequate escaping. This flaw can lead to stored cross-site scripting (XSS), allowing attackers to execute malicious JavaScript in the user's browser when the report is accessed. Organizations utilizing HAPI FHIR for healthcare interoperability should prioritize upgrading to version 6.9.11 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.