Information disclosure in Hl7 C-Cda

CVE-2014-3862

CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log.

Vulnerability class: Information Disclosure

EPSS: 0.013 (67.7th percentile) — read the EPSS interpretation.