Medical Informatics Engineering Enterprise Health Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Medical Informatics Engineering Enterprise Health. The issue resides in the 'portlet_user_id' URL parameter, allowing remote, unauthenticated attackers to inject and execute arbitrary JavaScript in the context of the victim's browser. This vulnerability affects several versions prior to the fixed release on March 14, 2025.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute malicious scripts in the context of the user's browser session.

Remediation

Users can update to the version released on March 14, 2025, to address this vulnerability.