CVE-2024-22725
Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS)...
Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.
- Record
CVE-2024-22725- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List
Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.
- Record
CVE-2024-22725- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-20256
Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.
- Record
EUVD-2024-20256- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j2p7-j8v8-q5g2
Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS)...
Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.
- Record
GHSA-j2p7-j8v8-q5g2- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.
- Record
CVE-2024-22725- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-22725
Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.
- Record
DEBIAN-CVE-2024-22725- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-22725
Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.
- Record
UBUNTU-CVE-2024-22725- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
orthancDebian:12 |
All versions, plus listed versions 1.10.1+dfsg-21.10.1+dfsg-2+deb12u11.12.1+dfsg-11.12.1+dfsg-21.12.1+dfsg-3 Show 32 moreShow less1.12.1+dfsg-41.12.10+dfsg-11.12.10+dfsg-21.12.10+dfsg-31.12.10+dfsg-41.12.10+dfsg-51.12.11+dfsg-11.12.11+dfsg-21.12.11+dfsg-31.12.11+dfsg-41.12.11+dfsg-51.12.11+dfsg-61.12.11+dfsg-71.12.11+dfsg-81.12.2+dfsg-11.12.3+dfsg-11.12.3+dfsg-21.12.4+dfsg-11.12.4+dfsg-21.12.4+dfsg-31.12.4+dfsg-41.12.5+dfsg-11.12.5+dfsg-21.12.6+dfsg-11.12.7+dfsg-11.12.7+dfsg-21.12.7+dfsg-31.12.7+dfsg-41.12.9+dfsg-11.12.9+dfsg-21.13.0+dfsg-11.13.0+dfsg-2 |
None known |
orthancDebian:13 |
before 1.12.2+dfsg-1 | 1.12.2+dfsg-1 |
orthancDebian:14 |
before 1.12.2+dfsg-1 | 1.12.2+dfsg-1 |
orthancUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.4+dfsg-10.9.4+dfsg-20.9.5+dfsg-11.0.0+dfsg-11.0.0+dfsg-1build1 |
None known |
orthancUbuntu:18.04:LTS |
All versions, plus listed versions 1.3.0+dfsg-1build11.3.0+dfsg-1build21.3.1+dfsg-11.3.1+dfsg-1build11.3.1+dfsg-1build2 |
None known |
orthancUbuntu:20.04:LTS |
All versions, plus listed versions 1.5.7+dfsg-21.5.8+dfsg-21.5.8+dfsg-2ubuntu21.5.8+dfsg-2ubuntu31.5.8+dfsg-2ubuntu41.5.8+dfsg-2ubuntu51.5.8+dfsg-2ubuntu6 |
None known |
orthancUbuntu:22.04:LTS |
All versions, plus listed versions 1.9.2+really1.9.1+dfsg-11.9.7+dfsg-3ubuntu11.9.7+dfsg-3ubuntu21.9.7+dfsg-41.9.7+dfsg-51.9.7+dfsg-61.10.0+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-22725 is a medium vulnerability (CVSS 6.1) in Orthanc-server Orthanc, published January 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in orthanc 1.12.2+dfsg-1.
References
orthanc.uclouvain.be/hg/orthanc/rev/505416b269a0
nvd.nist.gov/vuln/detail/CVE-2024-22725
github.com/advisories/GHSA-j2p7-j8v8-q5g2
security-tracker.debian.org/tracker/CVE-2024-22725
ubuntu.com/security/CVE-2024-22725
cve.org/CVERecord?id=CVE-2024-22725