CVE-2025-54459
BaseFortify
Publication date: 2025-10-29
Last updated on: 2025-11-06
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vertikalsystems | hospital_manager_backend_services | to 2025-09-19 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-497 | The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Hospital Manager Backend Services exposing the ASP.NET tracing endpoint /trace.axd without requiring authentication. This allows a remote attacker to access live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to obtain sensitive information that could be used to compromise the system further or gain unauthorized access. Exposure of session identifiers and authorization headers can lead to session hijacking or unauthorized actions within the system.