CVE-2025-58402

The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert.pl/en/posts/2026/03/CVE-2025-10350/	Third Party Advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:cgm:clininet:*:*:*:*:*:*:*:*

History

17 Jun 2026, 09:44

Type	Values Removed	Values Added
Summary		(es) La aplicación CGM CLININET utiliza identificadores de objeto directos y secuenciales 'MessageID' sin las comprobaciones de autorización adecuadas. Al modificar el parámetro en la solicitud GET, un atacante puede acceder a mensajes y archivos adjuntos pertenecientes a otros usuarios.

09 Mar 2026, 15:25

Type	Values Removed	Values Added
First Time		Cgm clininet Cgm
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CPE		cpe:2.3:a:cgm:clininet::::::::
References	~~() https://cert.pl/en/posts/2026/03/CVE-2025-10350/ -~~	() https://cert.pl/en/posts/2026/03/CVE-2025-10350/ - Third Party Advisory
References	~~() https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html -~~	() https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html - Product

02 Mar 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-02 12:16

Updated : 2026-06-17 09:44

NVD link : CVE-2025-58402

Mitre link : CVE-2025-58402

CVE.ORG link : CVE-2025-58402

JSON object : View

Products Affected

cgm

clininet

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-58402", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58402", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T12:35:35.178582Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "CGM", "product": "CGM CLININET", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.MS4", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-02T12:16:01.603", "references": [{"url": "https://cert.pl/en/posts/2026/03/CVE-2025-10350/", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html", "tags": ["Product"], "source": "cvd@cert.pl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The CGM CLININET application uses direct, sequential object identifiers \"MessageID\" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users."}, {"lang": "es", "value": "La aplicaci\u00f3n CGM CLININET utiliza identificadores de objeto directos y secuenciales 'MessageID' sin las comprobaciones de autorizaci\u00f3n adecuadas. Al modificar el par\u00e1metro en la solicitud GET, un atacante puede acceder a mensajes y archivos adjuntos pertenecientes a otros usuarios."}], "lastModified": "2026-06-17T09:44:24.430", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cgm:clininet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B694A79-45D0-4143-B56B-BB22D5A4E822", "versionEndExcluding": "2025.ms4"}], "operator": "OR"}]}], "sourceIdentifier": "cvd@cert.pl"}