What’s Vulnerable › Vulnerabilities

CVE-2022-37461

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-30 · updated 2026-06-17
• Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the (2) groupID, (3) offset, or (4) limit parameter to an Administrative Panel (Group and Users) page. There is a risk of an attacker retrieving patient information.

Affected products

• Canon Medical Vitrea View: from 7.0 before 7.7.6 — fixed in 7.7.6

How to fix

Upgrade to a fixed version: Canon Medical Vitrea View 7.7.6. Check the vendor advisory for mitigations.

References

• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=30693
• https://www.vitalimages.com/customer-success-support-program/vital-images-software-security-updates/
• https://www.vitalimages.com/vitrea-vision/vitrea-view/
• https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=30693
• https://www.vitalimages.com/customer-success-support-program/vital-images-software-security-updates/
• https://www.vitalimages.com/vitrea-vision/vitrea-view/

Get alerted when CVE-2022-37461 or the next vulnerability affects your stack