CVE-2025-27720 - Vulnerability Details - OpenCVE

The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-128-01
https://www.osirix-viewer.com/about/contact/
https://www.osirix-viewer.com/osirix/osirix-md/

History

Fri, 09 May 2025 04:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 08 May 2025 23:00:00 +0000

Type	Values Removed	Values Added
Description		The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.
Title		Pixmeo OsiriX MD Cleartext Transmission of Sensitive Information
Weaknesses		CWE-319
References		https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-128-01 https://www.osirix-viewer.com/about/contact/ https://www.osirix-viewer.com/osirix/osirix-md/
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2025-05-08T22:43:28.046Z

Updated: 2025-05-09T04:03:25.385Z

Reserved: 2025-04-03T20:57:04.866Z

Link: CVE-2025-27720

Vulnrichment

Updated: 2025-05-09T04:03:20.981Z

NVD

Status : Received

Published: 2025-05-08T23:15:51.993

Modified: 2025-05-08T23:15:51.993

Link: CVE-2025-27720

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27720", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2025-04-03T20:57:04.866Z", "datePublished": "2025-05-08T22:43:28.046Z", "dateUpdated": "2025-05-09T04:03:25.385Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OsiriX MD", "vendor": "Pixmeo", "versions": [{"lessThanOrEqual": "14.0.1 (Build 2024-02-28)", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Chizuru Toyama of TXOne Networks and Canaan Kao of TXOne Networks reported these vulnerabilities to CISA."}], "datePublic": "2025-05-08T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.</span>\n\n</span>\n\n</span>"}], "value": "The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-05-08T22:43:28.046Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-128-01"}, {"url": "https://www.osirix-viewer.com/osirix/osirix-md/"}, {"url": "https://www.osirix-viewer.com/about/contact/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Pixmeo recommends users to download the latest version of <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.osirix-viewer.com/osirix/osirix-md/\">OsiriX MD</a>.</p><p>For additional support regarding OsiriX MD, users should <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.osirix-viewer.com/about/contact/\">contact Pixmeo</a> directly.</p>\n\n<br>"}], "value": "Pixmeo recommends users to download the latest version of OsiriX MD https://www.osirix-viewer.com/osirix/osirix-md/ .\n\nFor additional support regarding OsiriX MD, users should contact Pixmeo https://www.osirix-viewer.com/about/contact/ \u00a0directly."}], "source": {"advisory": "ICSMA-25-128-01", "discovery": "EXTERNAL"}, "title": "Pixmeo OsiriX MD Cleartext Transmission of Sensitive Information", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-09T04:03:15.144661Z", "id": "CVE-2025-27720", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-09T04:03:25.385Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Pixmeo OsiriX MD Cleartext Transmission of Sensitive Information", "source": {"advisory": "ICSMA-25-128-01", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Chizuru Toyama of TXOne Networks and Canaan Kao of TXOne Networks reported these vulnerabilities to CISA."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Pixmeo", "product": "OsiriX MD", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "14.0.1 (Build 2024-02-28)"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Pixmeo recommends users to download the latest version of OsiriX MD https://www.osirix-viewer.com/osirix/osirix-md/ .\n\nFor additional support regarding OsiriX MD, users should contact Pixmeo https://www.osirix-viewer.com/about/contact/ \u00a0directly.", "supportingMedia": [{"type": "text/html", "value": "<p>Pixmeo recommends users to download the latest version of <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.osirix-viewer.com/osirix/osirix-md/\">OsiriX MD</a>.</p><p>For additional support regarding OsiriX MD, users should <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.osirix-viewer.com/about/contact/\">contact Pixmeo</a> directly.</p>\n\n<br>", "base64": false}]}], "datePublic": "2025-05-08T17:00:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-128-01"}, {"url": "https://www.osirix-viewer.com/osirix/osirix-md/"}, {"url": "https://www.osirix-viewer.com/about/contact/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.</span>\n\n</span>\n\n</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-05-08T22:43:28.046Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-27720", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-09T04:03:15.144661Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-05-09T04:03:20.981Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-27720", "state": "PUBLISHED", "dateUpdated": "2025-05-08T22:43:28.046Z", "dateReserved": "2025-04-03T20:57:04.866Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2025-05-08T22:43:28.046Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials."}], "id": "CVE-2025-27720", "lastModified": "2025-05-08T23:15:51.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "[email protected]", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}]}, "published": "2025-05-08T23:15:51.993", "references": [{"source": "[email protected]", "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-128-01"}, {"source": "[email protected]", "url": "https://www.osirix-viewer.com/about/contact/"}, {"source": "[email protected]", "url": "https://www.osirix-viewer.com/osirix/osirix-md/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "[email protected]", "type": "Primary"}]}