{"id":"CVE-2024-50589","aliases":["EUVD-2024-44966","GHSA-mvcm-644q-5c9p"],"status":"published","title":"Unprotected FHIR API","description":"An unauthenticated attacker with access to the local network of the \nmedical office can query an unprotected Fast Healthcare Interoperability\n Resources (FHIR) API to get access to sensitive electronic health \nrecords (EHR).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00572,"percentile":0.47747,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2024-11-08T11:34:33Z","modified":"2026-06-17T08:04:45Z","products":[{"vendor":"hasomed","product":"elefant"}],"references":[{"url":"https://r.sec-consult.com/hasomed","tags":["third-party-advisory"]},{"url":"https://hasomed.de/produkte/elefant/","tags":["patch"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50589"},{"url":"https://hasomed.de/produkte/elefant"},{"url":"https://github.com/advisories/GHSA-mvcm-644q-5c9p"}],"sources":{"cve":[{"id":"CVE-2024-50589","title":"Unprotected FHIR API","description":"An unauthenticated attacker with access to the local network of the \nmedical office can query an unprotected Fast Healthcare Interoperability\n Resources (FHIR) API to get access to sensitive electronic health \nrecords (EHR).","status":"published","published":"2024-11-08T11:34:33.967Z","modified":"2025-11-03T22:28:25.537Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-306","CWE-306"],"updated_at":"2026-11-02T14:34:21.784174Z"}],"euvd":[{"id":"EUVD-2024-44966","description":"An unauthenticated attacker with access to the local network of the \nmedical office can query an unprotected Fast Healthcare Interoperability\n Resources (FHIR) API to get access to sensitive electronic health \nrecords (EHR).","status":"published","published":"2024-11-08T11:34:33Z","modified":"2025-11-03T22:28:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-mvcm-644q-5c9p","title":"An unauthenticated attacker with access to the local network of the \nmedical office can query an...","description":"An unauthenticated attacker with access to the local network of the \nmedical office can query an unprotected Fast Healthcare Interoperability\n Resources (FHIR) API to get access to sensitive electronic health \nrecords (EHR).","status":"published","published":"2024-11-08T12:31:13Z","modified":"2025-11-04T00:32:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:04:30.147215Z"}],"nvd":[{"id":"CVE-2024-50589","description":"An unauthenticated attacker with access to the local network of the \nmedical office can query an unprotected Fast Healthcare Interoperability\n Resources (FHIR) API to get access to sensitive electronic health \nrecords (EHR).","status":"published","published":"2024-11-08T12:15:14.707Z","modified":"2026-06-17T08:04:45.62Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:10:36.560164Z"}]}}