CVE-2018-25298
Cross-Site Request Forgery in Merge PACS 7.0
Publication date: 2026-04-29
Last updated on: 2026-04-29
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| merative | merge_pacs | to 8.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Merge PACS 7.0 and is a cross-site request forgery (CSRF) issue. It allows attackers to craft malicious HTML forms that target the merge-viewer endpoint. By submitting specially crafted POST requests to the /servlet/actions/merge-viewer/summary URL with login credentials, attackers can hijack user sessions and gain unauthorized access to the PACS system.
Can you explain this vulnerability to me?
CVE-2018-25298 is a Cross-Site Request Forgery (CSRF) vulnerability in Merge PACS 7.0. It allows attackers to trick users into submitting malicious HTML forms targeting the merge-viewer endpoint. By doing so, attackers can send unauthorized POST requests to the /servlet/actions/merge-viewer/summary URL, potentially using stolen login credentials to hijack user sessions and gain unauthorized access to the PACS system.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized actions within the Merge PACS system. Specifically, attackers can hijack user sessions by submitting malicious requests with stolen credentials, which may allow them to access sensitive medical imaging data or perform actions without proper authorization. This compromises the security and integrity of the PACS system and could lead to data breaches or unauthorized manipulation of medical records.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests targeting the /servlet/actions/merge-viewer/summary endpoint, especially those attempting to use login credentials such as username 'merge' and password 'viewer'.
Network administrators can use tools like tcpdump or Wireshark to capture HTTP POST requests to this endpoint and look for unusual or unauthorized login attempts.
- Use tcpdump to filter HTTP POST requests to the vulnerable endpoint: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'POST /servlet/actions/merge-viewer/summary'
- Use curl or similar tools to test if the endpoint accepts POST requests with login credentials, e.g., curl -X POST http://target/servlet/actions/merge-viewer/summary -d 'username=merge&password=viewer'
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /servlet/actions/merge-viewer/summary endpoint to trusted users only and implementing CSRF protection mechanisms such as requiring anti-CSRF tokens for POST requests.
Additionally, changing default credentials (e.g., username 'merge' and password 'viewer') to strong, unique passwords will reduce the risk of unauthorized access.
Monitoring and blocking suspicious POST requests to the vulnerable endpoint via firewall or web application firewall (WAF) rules can also help mitigate exploitation attempts.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to the PACS system by hijacking user sessions. This means attackers can perform actions on behalf of legitimate users without their consent, potentially compromising sensitive medical imaging data and system integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2018-25298 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.