Is CVE-2017-5599 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-5599 being exploited in the wild.

How severe is CVE-2017-5599?

Medium severity, with a CVSS score of 6.1, published 27 January 2017.

Is there a fix for CVE-2017-5599?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2017-5599 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2017-5599?

Check whether you run Eclinicalworks Patient Portal. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-5599: eClinicalWorks Patient Portal reflected XSS in raceMasterList.jsp

CVE-2017-5599 · Severity: medium · CVSS 6.1 · Published 2017-01-27

A security vulnerability exists in the eClinicalWorks Patient Portal, a platform used by healthcare providers to share medical information with patients. An attacker could use this flaw to run malicious scripts in a patient's web browser if they click a specifically crafted link. This could lead to the theft of sensitive medical information or unauthorized access to the patient's account.

Technologies: Eclinicalworks Patient Portal. Vendors: Eclinicalworks.

Quick answers

Is CVE-2017-5599 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-5599 being exploited in the wild.
How severe is CVE-2017-5599?: Medium severity, with a CVSS score of 6.1, published 27 January 2017.
Which products and versions are affected?: eClinicalWorks Patient Portal 7.0 build 13.
Is there a fix for CVE-2017-5599?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2017-5599 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2017-5599?: Check whether you run Eclinicalworks Patient Portal. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in eClinicalWorks Patient Portal 7.0 build 13. The vulnerability is located in the 'race' parameter of the raceMasterList.jsp page, which fails to properly sanitize user-supplied input before rendering it in the response. Because this page does not require authentication, a remote attacker can craft a malicious URL and trick a user into clicking it. Successful exploitation allows the execution of arbitrary JavaScript in the victim's browser, potentially leading to session hijacking or the exfiltration of sensitive data displayed within the portal.

Affected products

eClinicalWorks Patient Portal 7.0 build 13

Timeline

2017-01-27: disclosed
2017-01-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.