Description
Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CompuGroup Medical | Infantia | ≤ 6.09.1, ≤ 5.1.1 | — |
| CompuGroup Medical | Profim | ≤ 6.09.1, ≤ 5.1.1 | — |
| CompuGroup Medical | Venere | ≤ 6.09.1, ≤ 5.1.1 | — |
| CompuGroup Medical | Phronesis | ≤ 6.09.1, ≤ 5.1.1 | — |