CGM CLININET Session Generation Vulnerability for Arbitrary Users

A vulnerability in CGM CLININET allows for the generation of sessions for arbitrary users due to an insufficiently secured internal function. The issue arises because the decodeParam function checks the JSON Web Token (JWT) but fails to verify the signing algorithm used. This flaw enables attackers to manipulate the 'ex:action' parameter in the VerifyUserByThrustedService function to create a session for any user. This vulnerability affects all versions of CGM CLININET prior to 2025.M2.

Impact

Exploitation of this vulnerability allows for unauthorized session generation, potentially leading to session hijacking.