CVE-2022-37461

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in Canon Medical Vitrea View versions 7.x prior to 7.7.6 [1]. An attacker can inject arbitrary web script or HTML through (1) input passed to the /vitrea-view/error/ subdirectory (likely via the URL path after 'error'), or through the (2) groupID, (3) offset, or (4) limit parameters on an Administrative Panel (Group and Users) page. No authentication is required to reach the error subdirectory; the administrative panel pages likely require prior administrator login, but the description does not specify [1].

Exploitation

For the error subdirectory vector, an attacker can craft a URL such as https://target/vitrea-view/error/ and lure a victim (potentially an authenticated user or administrator) to click the link. The injected script executes in the victim's browser session. For the administrative panel parameters, an attacker would need to be on an administrative page and manipulate the groupID, offset, or limit parameters (via a crafted URL or through a cross-site request forgery attack if the victim is already authenticated) [1]. The exact user interaction and authentication requirements are not fully detailed in the available reference, which only describes the vulnerability classes [1].

Impact

Successful exploitation could allow an attacker to execute arbitrary JavaScript within the context of the Vitrea View application. This could lead to session hijacking, theft of sensitive data displayed on administrative pages, or unauthorized actions on behalf of the victim user. Critically, the description notes there is a risk of an attacker retrieving patient information, which would represent a serious breach of protected health information (PHI) [1].

Mitigation

The vendor released version 7.7.6 to address these vulnerabilities. Organizations using Canon Medical Vitrea View 7.x should upgrade to version 7.7.6 or later immediately. No workarounds are mentioned in the available reference [1]. If upgrading is not immediately possible, restricting network access to the administrative panel and educating users about phishing links may reduce risk, but these are not complete mitigations. The CVE is not known to be listed on the CISA KEV catalogue.