{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12473", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-06-16T20:16:53.716Z", "datePublished": "2026-06-25T20:38:32.998Z", "dateUpdated": "2026-06-25T20:38:32.998Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-06-25T20:38:32.998Z"}, "title": "OHIF Viewers DICOM Server-Side request forgery", "datePublic": "2026-06-25T17:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "CWE-918 Server-Side request forgery (SSRF)", "type": "CWE"}]}], "affected": [{"vendor": "Open Health Imaging Foundation (OHIF)", "product": "DICOM Web Viewer Framework", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "v3.12.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted."}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsma-26-176-02"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-176-02.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"}}], "workarounds": [{"lang": "en", "value": "Users running OHIF with authentication should remove ALL unused DicomWebProxyDataSource and DicomJSONDataSource configurations from the configuration file they are deploying with.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Users running OHIF with authentication should remove ALL unused DicomWebProxyDataSource and DicomJSONDataSource configurations from the configuration file they are deploying with."}]}, {"lang": "en", "value": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:\n\n * Minimize network exposure for all control system devices and/or \nsystems, ensuring they are not accessible from the \ninternet. https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01 \u00a0\n * Locate control system networks and remote devices behind firewalls and isolating them from business networks.\n\n * When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have \nvulnerabilities and should be updated to the most current version \navailable. Also recognize VPN is only as secure as the connected \ndevices.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:\n<br><ul><li>Minimize network exposure for all control system devices and/or \nsystems, ensuring they are not accessible from the \ninternet. <a href=\"https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01\">https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01</a>&nbsp;</li><li>Locate control system networks and remote devices behind firewalls and isolating them from business networks.\n</li><li>When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have \nvulnerabilities and should be updated to the most current version \navailable. Also recognize VPN is only as secure as the connected \ndevices.\n\n</li></ul>"}]}], "solutions": [{"lang": "en", "value": "The maintainer has fixed the reported vulnerability and released version 3.12.2 (2026-05-18). The fix is located at OHIF/Viewers#5985 (master), OHIF/Viewers#5978 (release/3.12).\n\nUsers are recommended to upgrade to v3.12.2 or later. Operators who need dicomwebproxy or dicomjson in authenticated deployments must additionally configure the new dangerouslyAllowedOriginsForAuthenticatedEnvironments allowlist in app-config.js.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The maintainer has fixed the reported vulnerability and released version 3.12.2 (2026-05-18). The fix is located at OHIF/Viewers#5985 (master), OHIF/Viewers#5978 (release/3.12).<br><br>Users are recommended to upgrade to v3.12.2 or later. Operators who need dicomwebproxy or dicomjson in authenticated deployments must additionally configure the new dangerouslyAllowedOriginsForAuthenticatedEnvironments allowlist in app-config.js.&nbsp;"}]}], "credits": [{"lang": "en", "value": "Simon Weber and Volker Sch\u00f6nefeld of Machine Spirits UG reported this vulnerability to CISA.", "type": "finder"}], "source": {"advisory": "ICSMA-26-176-02", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}}}

{}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,v3.12.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "DICOM Web Viewer Framework", "source": "cna", "vendor": "Open Health Imaging Foundation (OHIF)"}, "product": "dicom_web_viewer_framework", "vendor": "open_health_imaging_foundation"}], "created": "2026-06-25T22:30:15.193362+00:00", "updated": "2026-06-26T09:36:22.716096+00:00", "vendors": ["open_health_imaging_foundation", "open_health_imaging_foundation$PRODUCT$dicom_web_viewer_framework"]}