CGM CLININET Missing Authentication Vulnerability Allowing Unrestricted Access to Internal Endpoints

A vulnerability exists in CGM CLININET software, all versions prior to 2025.M2, allowing unauthenticated access to several endpoints that should be restricted to internal services. These endpoints, typically including '/int/' in their path, are publicly accessible to any host that can reach the application server on port 443/tcp.

Impact

Exploitation of this vulnerability could lead to unauthorized access to internal services, potentially allowing for further exploitation of the application or its users.