Chained exploitation of this vulnerability and CVE-2025-8307 allows an attacker to escalate privileges. This vulnerability has been fixed in versions 4.50.1 and 5.38.0
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Asseco | InfoMedica Plus | unaffected |
|
No data.
No data.
No data available yet.
No remediation available yet.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://cert.pl/en/posts/2026/01/CVE-2025-8306/ |
|
Thu, 08 Jan 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 08 Jan 2026 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts (including main administrator) due to lack of granularity in access control. Chained exploitation of this vulnerability and CVE-2025-8307 allows an attacker to escalate privileges. This vulnerability has been fixed in versions 4.50.1 and 5.38.0 | |
| Title | Improper Access Control in Asseco Infomedica Plus | |
| Weaknesses | CWE-1220 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2026-01-08T14:23:20.313Z
Reserved: 2025-07-29T12:07:30.706Z
Link: CVE-2025-8306
Vulnrichment
Updated: 2026-01-08T14:23:17.516Z
NVD
Status : Awaiting Analysis
Published: 2026-01-08T14:15:56.693
Modified: 2026-01-08T18:08:18.457
Link: CVE-2025-8306
Redhat
No data.
OpenCVE Enrichment
No data.