CVE-2026-12473

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12473", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-06-16T20:16:53.716Z", "datePublished": "2026-06-25T20:38:32.998Z", "dateUpdated": "2026-06-26T13:05:53.810Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-06-25T20:38:32.998Z"}, "title": "OHIF Viewers DICOM Server-Side request forgery", "datePublic": "2026-06-25T17:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "CWE-918 Server-Side request forgery (SSRF)", "type": "CWE"}]}], "affected": [{"vendor": "Open Health Imaging Foundation (OHIF)", "product": "DICOM Web Viewer Framework", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "v3.12.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted."}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsma-26-176-02"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-176-02.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"}}], "workarounds": [{"lang": "en", "value": "Users running OHIF with authentication should remove ALL unused DicomWebProxyDataSource and DicomJSONDataSource configurations from the configuration file they are deploying with.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Users running OHIF with authentication should remove ALL unused DicomWebProxyDataSource and DicomJSONDataSource configurations from the configuration file they are deploying with."}]}, {"lang": "en", "value": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:\n\n * Minimize network exposure for all control system devices and/or \nsystems, ensuring they are not accessible from the \ninternet. https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01 \u00a0\n * Locate control system networks and remote devices behind firewalls and isolating them from business networks.\n\n * When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have \nvulnerabilities and should be updated to the most current version \navailable. Also recognize VPN is only as secure as the connected \ndevices.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:\n<br><ul><li>Minimize network exposure for all control system devices and/or \nsystems, ensuring they are not accessible from the \ninternet. <a href=\"https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01\">https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01</a>&nbsp;</li><li>Locate control system networks and remote devices behind firewalls and isolating them from business networks.\n</li><li>When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have \nvulnerabilities and should be updated to the most current version \navailable. Also recognize VPN is only as secure as the connected \ndevices.\n\n</li></ul>"}]}], "solutions": [{"lang": "en", "value": "The maintainer has fixed the reported vulnerability and released version 3.12.2 (2026-05-18). The fix is located at OHIF/Viewers#5985 (master), OHIF/Viewers#5978 (release/3.12).\n\nUsers are recommended to upgrade to v3.12.2 or later. Operators who need dicomwebproxy or dicomjson in authenticated deployments must additionally configure the new dangerouslyAllowedOriginsForAuthenticatedEnvironments allowlist in app-config.js.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The maintainer has fixed the reported vulnerability and released version 3.12.2 (2026-05-18). The fix is located at OHIF/Viewers#5985 (master), OHIF/Viewers#5978 (release/3.12).<br><br>Users are recommended to upgrade to v3.12.2 or later. Operators who need dicomwebproxy or dicomjson in authenticated deployments must additionally configure the new dangerouslyAllowedOriginsForAuthenticatedEnvironments allowlist in app-config.js.&nbsp;"}]}], "credits": [{"lang": "en", "value": "Simon Weber and Volker Sch\u00f6nefeld of Machine Spirits UG reported this vulnerability to CISA.", "type": "finder"}], "source": {"advisory": "ICSMA-26-176-02", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T13:05:47.331920Z", "id": "CVE-2026-12473", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T13:05:53.810Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12473", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T13:05:47.331920Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T13:05:50.687Z"}}], "cna": {"title": "OHIF Viewers DICOM Server-Side request forgery", "source": {"advisory": "ICSMA-26-176-02", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Simon Weber and Volker Sch\u00f6nefeld of Machine Spirits UG reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Open Health Imaging Foundation (OHIF)", "product": "DICOM Web Viewer Framework", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "v3.12.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The maintainer has fixed the reported vulnerability and released version 3.12.2 (2026-05-18). The fix is located at OHIF/Viewers#5985 (master), OHIF/Viewers#5978 (release/3.12).\n\nUsers are recommended to upgrade to v3.12.2 or later. Operators who need dicomwebproxy or dicomjson in authenticated deployments must additionally configure the new dangerouslyAllowedOriginsForAuthenticatedEnvironments allowlist in app-config.js.", "supportingMedia": [{"type": "text/html", "value": "The maintainer has fixed the reported vulnerability and released version 3.12.2 (2026-05-18). The fix is located at OHIF/Viewers#5985 (master), OHIF/Viewers#5978 (release/3.12).<br><br>Users are recommended to upgrade to v3.12.2 or later. Operators who need dicomwebproxy or dicomjson in authenticated deployments must additionally configure the new dangerouslyAllowedOriginsForAuthenticatedEnvironments allowlist in app-config.js.&nbsp;", "base64": false}]}], "datePublic": "2026-06-25T17:00:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsma-26-176-02"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-176-02.json"}], "workarounds": [{"lang": "en", "value": "Users running OHIF with authentication should remove ALL unused DicomWebProxyDataSource and DicomJSONDataSource configurations from the configuration file they are deploying with.", "supportingMedia": [{"type": "text/html", "value": "Users running OHIF with authentication should remove ALL unused DicomWebProxyDataSource and DicomJSONDataSource configurations from the configuration file they are deploying with.", "base64": false}]}, {"lang": "en", "value": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:\n\n * Minimize network exposure for all control system devices and/or \nsystems, ensuring they are not accessible from the \ninternet. https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01 \u00a0\n * Locate control system networks and remote devices behind firewalls and isolating them from business networks.\n\n * When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have \nvulnerabilities and should be updated to the most current version \navailable. Also recognize VPN is only as secure as the connected \ndevices.", "supportingMedia": [{"type": "text/html", "value": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:\n<br><ul><li>Minimize network exposure for all control system devices and/or \nsystems, ensuring they are not accessible from the \ninternet. <a href=\"https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01\">https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01</a>&nbsp;</li><li>Locate control system networks and remote devices behind firewalls and isolating them from business networks.\n</li><li>When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have \nvulnerabilities and should be updated to the most current version \navailable. Also recognize VPN is only as secure as the connected \ndevices.\n\n</li></ul>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.", "supportingMedia": [{"type": "text/html", "value": "Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side request forgery (SSRF)"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-06-25T20:38:32.998Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12473", "state": "PUBLISHED", "dateUpdated": "2026-06-26T13:05:53.810Z", "dateReserved": "2026-06-16T20:16:53.716Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-06-25T20:38:32.998Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "DICOM Web Viewer Framework", "vendor": "Open Health Imaging Foundation (OHIF)", "versions": [{"lessThanOrEqual": "v3.12.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted."}, {"lang": "es", "value": "Dos fuentes de datos (DICOMWebProxy y DICOMJSON) incluidas en la configuraci\u00f3n predeterminada obtienen un par\u00e1metro URL arbitrario sin validaci\u00f3n. Un servicio de autenticaci\u00f3n global en OHIF inyecta autom\u00e1ticamente el token OIDC Bearer del usuario autenticado en las solicitudes resultantes, envi\u00e1ndolo al servidor controlado por el atacante. Las fuentes de datos DICOMweb no se ven afectadas."}], "id": "CVE-2026-12473", "lastModified": "2026-10-25T22:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12473", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T13:05:47.331920Z", "version": "2.0.3"}}]}, "published": "2026-06-25T21:16:26.530", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-176-02.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsma-26-176-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,v3.12.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "DICOM Web Viewer Framework", "source": "cna", "vendor": "Open Health Imaging Foundation (OHIF)"}, "product": "dicom_web_viewer_framework", "vendor": "open_health_imaging_foundation"}], "created": "2026-06-25T22:30:15.193362+00:00", "updated": "2026-06-26T09:36:22.716096+00:00", "vendors": ["open_health_imaging_foundation", "open_health_imaging_foundation$PRODUCT$dicom_web_viewer_framework"]}