Critical · 9.0 CVE-2025-30041 EUVD-2025-27768GHSA-wc4p-g368-6p6h

Missing authentication in APIs returning statistical data along with session IDs

Published Aug 27, 2025 · Updated Aug 27, 2025 · Assigned by CERT-PL

Description

The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data containing session IDs.

Affected products

Vendor	Product	Affected	Fixed
CGM	CGM CLININET	< 2025.MS1	2025.MS1

References

https://cert.pl/en/posts/2025/08/CVE-2025-2313/