Orthanc Server missing authentication for critical functions
Orthanc Server versions before 1.5.8 lack default basic authentication when remote access is enabled, allowing potential remote attackers to access sensitive healthcare information or cause service disruption. The vulnerability was officially documented by CISA with a high severity rating.
What happened
Orthanc Server versions prior to 1.5.8 do not enable basic authentication by default when remote access is enabled, creating a missing authentication vulnerability for critical functions.
Reported impact
Successful exploitation could allow an attacker to disclose sensitive information, modify records, or cause a denial-of-service condition.
Index analysis
The vulnerability has a CVSS v3.1 base score of 9.8 and CVSS v4 score of 9.2, with remote exploitability and low attack complexity.
Governance controls
Orthanc recommends users update to version 1.5.8 or enable HTTP authentication by setting 'AuthenticationEnabled': true in the configuration file.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.