A high-severity vulnerability in Pathling allows for potential server-side request forgery and unauthorized data access due to improper input validation and verification.

The software is affected by multiple weaknesses, including improper input validation (CWE-20), insufficient data authenticity verification (CWE-345), and server-side request forgery (CWE-918). These flaws allow an authenticated attacker to manipulate input parameters to perform unauthorized requests or bypass data verification checks.

The CVSS score of 8.6 reflects the severity of these vulnerabilities in a health data analytics context. Exploitation could lead to unauthorized access to clinical terminology and FHIR data, or allow an attacker to leverage the server as a proxy to interact with internal infrastructure. This poses a severe risk to data confidentiality and the integrity of sensitive healthcare analytics environments.

Immediate Action: Upgrade Pathling to version 2.0.0 or later to address the identified input validation and SSRF vulnerabilities.

Proactive Monitoring: Review application and network logs for suspicious outbound requests originating from the Pathling server, which may indicate attempted SSRF exploitation.

Compensating Controls: Implement strict egress filtering on the server hosting Pathling to prevent it from reaching unauthorized internal or external network segments.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing Pathling for health data analytics must update to version 2.0.0 immediately. Ensuring that input validation and request filtering are strictly enforced is critical for protecting the integrity of the clinical data managed by this platform.