Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. This issue is fixed as of 2025-03-14.
Weakness
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Enterprise_health | Mieweb | rc202303 (including) | rc202303 (including) |
| Enterprise_health | Mieweb | rc202309 (including) | rc202309 (including) |
| Enterprise_health | Mieweb | rc202403 (including) | rc202403 (including) |
| Enterprise_health | Mieweb | rc202409 (including) | rc202409 (including) |
| Enterprise_health | Mieweb | rc202503 (including) | rc202503 (including) |