CVE-2015-6538

The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2015-12-27

Last modified

2024-08-06

Affected products

• Cardio Server (Ephiphanyheathdata)

References

• http://www.epiphanyhealthdata.com/blog/certresponse
• https://www.kb.cert.org/vuls/id/630239