Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-37461

Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the (2) groupID, (3) offset, or (4) limit parameter to an Administrative Panel (Group and Users) page. There is a risk of an attacker retrieving patient information.

Published

2022-09-30T14:15:09.537

Last Modified

2025-05-20T20:15:23.097

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.1 (MEDIUM)

Weaknesses

Type: Primary
CWE-79
Type: Secondary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	canon	medical_vitrea_view	< 7.7.6	Yes

References

https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=30693 Exploit, Third Party Advisory ([email protected])
https://www.vitalimages.com/customer-success-support-program/vital-images-software-security-updates/ Vendor Advisory ([email protected])
https://www.vitalimages.com/vitrea-vision/vitrea-view/ Product, Vendor Advisory ([email protected])
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=30693 Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.vitalimages.com/customer-success-support-program/vital-images-software-security-updates/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.vitalimages.com/vitrea-vision/vitrea-view/ Product, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)