Medium severity6.1NVD Advisory· Published Jun 5, 2019· Updated Jun 17, 2026
CVE-2019-12741
CVE-2019-12741
Description
XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.)
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ca.uhn.hapi.fhir:hapi-fhir-baseMaven | < 3.8.0 | 3.8.0 |
Affected products
3- HAPI FHIR library/HAPI FHIR librarydescription
Patches
Vulnerability mechanics
References
5- github.com/jamesagnew/hapi-fhir/commit/8f41159eb147eeb964cad68b28eff97acac6ea9anvdPatchThird Party AdvisoryWEB
- github.com/jamesagnew/hapi-fhir/issues/1335nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-52mh-p2m2-w625ghsaADVISORY
- github.com/jamesagnew/hapi-fhir/releases/tag/v3.8.0nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2019-12741ghsaADVISORY
News mentions
0No linked articles in our index yet.