CVE-2025-30035: Lack of API authentication allowing session generation for any user
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30035?
CVE-2025-30035 is considered a critical vulnerability due to the potential for complete authentication bypass.
What products are affected by CVE-2025-30035?
CVE-2025-30035 affects the CGM CLININET software.
How do I fix CVE-2025-30035?
To mitigate CVE-2025-30035, implement proper API authentication mechanisms to ensure secure access control.
What impact does CVE-2025-30035 have on user accounts?
CVE-2025-30035 allows an attacker to access any active user account without needing a password or other credentials.
Who should be concerned about CVE-2025-30035?
Organizations using CGM CLININET should be concerned about CVE-2025-30035 due to the risk of unauthorized access to sensitive user data.