CVE-2025-27955
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.3%
exploitation probability
0.3%top 79% of all CVEs
observed exploitation
nono source reports it
In short
After logging out of Clinical Collaboration Platform 12.2.1.5, the session token stays active and can be reused by attackers to access sensitive patient data or run malicious code. This happens because the logout function doesn't properly invalidate the token.
Technical detail
The platform fails to invalidate session tokens upon logout (CWE-1259), allowing authenticated attackers to reuse valid tokens post-logout to access protected resources and potentially execute arbitrary code. This requires knowledge of a valid token but enables information disclosure and code execution without re-authentication.
Summary generated and translated by AI from the official description.
Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information and execute arbitrary code.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
n/a · n/a