High · 7.1 CVE-2023-7238 EUVD-2023-59419GHSA-rv57-pvch-f98r

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer

Published Jan 23, 2024 · Updated Jun 17, 2025 · Assigned by icscert

Vendor: Orthanc Product: Osimis DICOM Web Viewer

Description

A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered. If exploited, the attacker will be able to execute arbitrary JavaScript code inside the victim's browser.

Affected products

Vendor	Product	Affected	Fixed
Orthanc	Osimis DICOM Web Viewer	1.4.2.0-9d9eff4	—

Advisories 1

ICSMA-24-023-01 Orthanc Osimis DICOM Web Viewer CISA ICS & IT advisories · Jan 23, 2024

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01 government-resource