Medical Informatics Engineering Enterprise Health unrestricted upload
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 5.9 | $0-$5k | 0.00 |
Summary
A vulnerability identified as critical has been detected in Medical Informatics Engineering Enterprise Health. Affected by this vulnerability is an unknown functionality. This manipulation causes unrestricted upload. This vulnerability appears as CVE-2025-35032. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.
Details
A vulnerability was found in Medical Informatics Engineering Enterprise Health (affected version not known). It has been declared as critical. Affected by this vulnerability is some unknown functionality. The manipulation with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:
Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.
The advisory is shared at raw.githubusercontent.com. This vulnerability is known as CVE-2025-35032 since 04/15/2025. The exploitation appears to be easy. The attack can be launched remotely. Additional levels of successful authentication are necessary for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1608.002 for this issue.
Upgrading eliminates this vulnerability.
The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-31615). If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Product
Type
Vendor
Name
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔒VulDB Reliability: 🔍
CNA CVSS-B Score: 🔒
CNA CVSS-BT Score: 🔒
CNA Vector: 🔒
CVSSv3
VulDB Meta Base Score: 6.0VulDB Meta Temp Score: 5.9
VulDB Base Score: 4.7
VulDB Temp Score: 4.5
VulDB Vector: 🔒
VulDB Reliability: 🔍
NVD Base Score: 9.9
NVD Vector: 🔒
CNA Base Score: 3.4
CNA Vector (cisa-cg): 🔒
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Unrestricted uploadCWE: CWE-434 / CWE-284 / CWE-266
CAPEC: 🔒
ATT&CK: 🔒
Physical: No
Local: No
Remote: Yes
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔒
Timeline
04/08/2025 Countermeasure disclosed04/15/2025 CVE reserved
09/29/2025 Advisory disclosed
09/29/2025 VulDB entry created
01/03/2026 VulDB entry last update
Sources
Advisory: raw.githubusercontent.comStatus: Confirmed
CVE: CVE-2025-35032 (🔒)
GCVE (CVE): GCVE-0-2025-35032
GCVE (VulDB): GCVE-100-326293
EUVD: 🔒
Entry
Created: 09/29/2025 22:22Updated: 01/03/2026 01:50
Changes: 09/29/2025 22:22 (75), 09/30/2025 00:04 (1), 01/03/2026 01:50 (11)
Complete: 🔍
Cache ID: 216::103
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
No comments yet. Languages: en.
Please log in to comment.