CVE-2022-1067

ICSMA-22-095-01 LifePoint Informatics Patient Portal

Description

Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting.

Remediation

Workaround:

  • LifePoint Informatics released and deployed updated Version LPI 3.5.15 in February of 2022, which mitigated this vulnerability. LifePoint Informatics Patient Portal is a hosted application and users don’t need to take any action.

Categories

6.5
CVSS
Severity: Medium
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.14%
Third-Party Advisory cisa.gov
Affected: LifePoint Informatics Patient Portal
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/uscert/ics/advisories/icsma-22-095-01 third party advisory us government resource

Frequently Asked Questions

What is the severity of CVE-2022-1067?
CVE-2022-1067 has been scored as a medium severity vulnerability.
How to fix CVE-2022-1067?
As a workaround for remediating CVE-2022-1067: LifePoint Informatics released and deployed updated Version LPI 3.5.15 in February of 2022, which mitigated this vulnerability. LifePoint Informatics Patient Portal is a hosted application and users don’t need to take any action.
Is CVE-2022-1067 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-1067 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-1067?
CVE-2022-1067 affects LifePoint Informatics Patient Portal.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.