CGM CLININET Authentication Bypass Vulnerability Allowing Session Takeover

An authentication bypass vulnerability has been identified in CGM CLININET, all versions prior to 2025.MS4. This vulnerability allows an attacker to gain access to any active user account by simply providing the username, without needing a password or any other credentials. Once a session ID is obtained, it can be used for session takeover, granting access to the system with the privileges of the targeted user.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, with full privileges of the targeted user, enabling session takeover.