Improper Access Control in e-Sushrut API Enables Data Exposure

Executive Summary

This vulnerability exists in the e-Sushrut system due to improper access control in resource access validation.

An authenticated attacker can exploit this by manipulating a parameter in the API request URL to gain unauthorized access to sensitive patient information on the targeted system.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with valid authentication to bypass access controls and access sensitive patient information without authorization.

This can lead to exposure of confidential patient data, potentially resulting in privacy breaches and misuse of personal health information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated attacker to gain unauthorized access to sensitive patient information by exploiting improper access control in the e-Sushrut system.

Such unauthorized access to sensitive patient data can lead to violations of data protection regulations and standards such as GDPR and HIPAA, which mandate strict controls on access to personal and health information.

Therefore, this vulnerability negatively impacts compliance with these common standards by exposing protected health information to unauthorized parties.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the e-Sushrut system due to improper access control in resource access validation.

An authenticated attacker can exploit this vulnerability by manipulating a parameter in the API request URL.

This manipulation allows the attacker to gain unauthorized access to sensitive patient information on the targeted system.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive patient information.

This unauthorized access can compromise patient privacy and potentially lead to misuse of confidential data.

Such a breach can damage trust in the affected healthcare system and may result in legal and financial consequences.

Useful 0 Not Useful 0