CVE-2021-40375

    Dashboard / Vulnerabilities / CVE-2021-40375

    CVE-2021-40375

    Published: 6 Apr 2022Last Modified: 9 Jul 2026

    Summary:

    Details: Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This response can be read in an intercepting proxy or by viewing the page source. Sensitive information returned in responses includes patient PII and medication records or history.

    References: https://openeyes.apperta.org/, https://github.com/DCKento/CVE-2021-40375

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- c079383d2033404b8a5af7c2f552843444f3440a
    Fixed -None

    Affected versions

    3.5.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-40375 | CVE-DB