CVE-2026-49120
🟡 Monitoruj
Wykorzystanie SSRF w Medplum umożliwia wyciek danych z wewnętrznych usług sieciowych.
CVSS
8.5
EPSS
0.0%
Exploit
none
Vendor
Opis źródłowy (NVD)
Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscription endpoints at internal addresses such as cloud instance metadata services, internal databases, or container orchestration endpoints to exfiltrate IAM credentials and patient health records via the POST body containing full FHIR resource payloads.
ssrf
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 8.5 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.0% |
| Opublikowano (NVD) | 2026-06-02 20:16:39 UTC |
| Ostatnia modyfikacja (NVD) | 2026-06-04 16:10:59 UTC |
Referencje
- https://github.com/medplum/medplum/commit/87595e98d756d840d70d9dc87beb9d4f9e158b59 (disclosure@vulncheck.com)
- https://github.com/medplum/medplum/pull/9334 (disclosure@vulncheck.com)
- https://github.com/medplum/medplum/releases/tag/v5.1.14 (disclosure@vulncheck.com)
- https://www.vulncheck.com/advisories/medplum-ssrf-via-fhir-subscription-endpoint (disclosure@vulncheck.com)