CVE-2025-8307

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software. This vulnerability has been fixed in versions 4.50.1 and 5.38.0

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/01/CVE-2025-8306/

Configurations

No configuration.

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Asseco InfoMedica es una solución integral utilizada para gestionar tanto tareas administrativas como médicas en el sector sanitario. Las contraseñas de todos los usuarios se almacenan en una base de datos en un formato codificado. Un atacante en posesión de estas contraseñas codificadas es capaz de decodificarlas utilizando un algoritmo incrustado en la parte del lado del cliente del software. Esta vulnerabilidad ha sido corregida en las versiones 4.50.1 y 5.38.0.

Information

Published : 2026-01-08 14:15

Updated : 2026-10-07 09:10

NVD link : CVE-2025-8307

Mitre link : CVE-2025-8307

CVE.ORG link : CVE-2025-8307

JSON object : View

Products Affected

No product.

CWE

CWE-257

Storing Passwords in a Recoverable Format

{"id": "CVE-2025-8307", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8307", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T14:18:46.776974Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "Asseco", "product": "InfoMedica Plus", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.38.0", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.50.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-08T14:15:56.873", "references": [{"url": "https://cert.pl/en/posts/2026/01/CVE-2025-8306/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-257"}]}], "descriptions": [{"lang": "en", "value": "Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software.\u00a0\nThis vulnerability has been fixed in versions\u00a04.50.1 and 5.38.0"}, {"lang": "es", "value": "Asseco InfoMedica es una soluci\u00f3n integral utilizada para gestionar tanto tareas administrativas como m\u00e9dicas en el sector sanitario. Las contrase\u00f1as de todos los usuarios se almacenan en una base de datos en un formato codificado. Un atacante en posesi\u00f3n de estas contrase\u00f1as codificadas es capaz de decodificarlas utilizando un algoritmo incrustado en la parte del lado del cliente del software. Esta vulnerabilidad ha sido corregida en las versiones 4.50.1 y 5.38.0."}], "lastModified": "2026-10-07T09:10:00.160", "sourceIdentifier": "cvd@cert.pl"}