GCVE - cpe:2.3:a:hl7:c-cda:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:hl7:c-cda:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Hl7 (`726611bc-b4b1-5404-ad83-44fd363e74c6`)
Product	C Cda (`e21e277b-58a1-500b-b8f6-70eb2cec5b26`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/hl7/cda-core-2.0`	purl2cpe	2026-06-01 10:16:32.578207

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-5452`	vulnerable	2026-06-08 05:05:47.954892	Details available CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations. Published: 2014-09-02T10:00:00.000Z Updated: 2024-08-06T11:48:48.475Z Open on db.gcve.eu Reference links http://motorcycleguy.blogspot.com/2014/04/hl7-cda-stylesheet-patches.html http://www.securityfocus.com/bid/69633 http://gforge.hl7.org/gf/project/strucdoc/frs/?action=FrsReleaseView&release_id=1088 http://smartplatforms.org/2014/04/security-vulnerabilities-in-ccda-display/ http://www.securitytracker.com/id/1033511	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3862`	vulnerable	2026-06-08 05:05:43.063806	Details available CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log. Published: 2014-09-02T10:00:00.000Z Updated: 2024-08-06T10:57:17.866Z Open on db.gcve.eu Reference links http://motorcycleguy.blogspot.com/2014/04/hl7-cda-stylesheet-patches.html http://gforge.hl7.org/gf/project/strucdoc/frs/?action=FrsReleaseView&release_id=1088 http://smartplatforms.org/2014/04/security-vulnerabilities-in-ccda-display/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3861`	vulnerable	2026-06-08 05:05:43.063419	Details available Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element. Published: 2014-09-02T10:00:00.000Z Updated: 2024-08-06T10:57:17.682Z Open on db.gcve.eu Reference links http://motorcycleguy.blogspot.com/2014/04/hl7-cda-stylesheet-patches.html http://gforge.hl7.org/gf/project/strucdoc/frs/?action=FrsReleaseView&release_id=1088 http://smartplatforms.org/2014/04/security-vulnerabilities-in-ccda-display/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.