Riskcovery

CVE-2025-35033

Medical Informatics Engineering Enterprise Health CSV injection

State
Published
Severity
6.3 Medium
Published
Sep 29, 2025
Updated
Sep 30, 2025
Reserved
Apr 15, 2025

Read the record on cve.org

Description

Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. This issue is fixed as of 2025-03-14.

Scores

CVSSScoreVectorSource
4.06.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:H/SI:H/SA:Hcisa-cg
3.14.1 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:Ncisa-cg

Weaknesses

  • CWE-1236 Improper Neutralization of Formula Elements in a CSV File

Affected Products

ProductVersions
Enterprise HealthMedical Informatics Engineering
  • RC202503 to before RC202503 2025-03-14Affected
  • RC202409 to before RC202409 2025-03-14Affected
  • RC202403 to before RC202403 2025-03-14Affected
  • RC202309 to before RC202309 2025-03-14Affected
  • RC202303 to before RC202303 2025-03-14Affected
  • RC202503 2025-03-14Not affected
  • RC202409 2025-03-14Not affected
  • RC202403 2025-03-14Not affected
  • RC202309 2025-03-14Not affected
  • RC202303 2025-03-14Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.