Infantiaなど4製品の更新機能に脆弱性、修正を配信
Summary
CompuGroup Medicalの薬局・診療所向けソフトで、更新機能が正当性を確認せずにコードを実行する脆弱性が公表されました。修正は自動配信とされているため、4製品の利用組織は適用済みかを確認してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
CompuGroup Medicalの薬局・診療所向けソフトで、更新機能が正当性を確認せずにコードを実行する脆弱性が公表されました。修正は自動配信とされているため、4製品の利用組織は適用済みかを確認してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| CompuGroup MedicalInfantia |
≤ 2.12.0→ Not listed |
Not listed |
| CompuGroup MedicalProfim |
≤ 2.12.0→ Not listed |
Not listed |
| CompuGroup MedicalVenere |
≤ 2.12.0→ Not listed |
Not listed |
| CompuGroup MedicalPhronesis |
≤ 2.12.0→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web acn.gov.it
- web cgm.com
- web nvd.nist.gov
- web github.com