Vulnerability

Philips Tasy EMR and WebPortal carry cross-site scripting and information exposure flaws

MedDevice Cyber Staff · Apr 30 · 2 min read · Via CISA ICSMA-19-120-01

CISA published advisory ICSMA-19-120-01 on April 30, 2019, later revised as Update A, covering Philips Tasy EMR versions 3.01.1744 and prior and Tasy WebPortal versions 3.02.1757 and prior. Rafael Honorato and the IT department of Unimed de Blumenau Cooperativa de Trabalho Médico reported the issues.

CVE-2019-6562 (CWE-79, CVSS v3 4.1) is cross-site scripting: user-controllable input lands in pages served to other users. CVE-2019-13557 (CWE-200, CVSS 4.3) lets a remote attacker with low privileges read system and configuration information. Philips' analysis said a low-skill attacker could feed unexpected input to the application, execute code, alter control flow and access sensitive information.

Philips advises updating Tasy EMR to 3.03.1745 or higher and Tasy WebPortal to 3.03.1758 or higher, following the Tasy release schedule. Hosted customers are patched automatically. On-premise customers should apply service packs as soon as possible and harden the application server per its manufacturer's documentation.

An EMR renders text that hundreds of users typed, so output encoding is the default for every field, with no exceptions for internal screens.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update Tasy EMR to 3.03.1745 or higher and Tasy WebPortal to 3.03.1758 or higher; hosted customers receive the fix automatically. On-premise sites should apply service packs promptly and follow the application server vendor's security guidance.

Apply the Tasy updates. Move Tasy EMR to 3.03.1745 or later and WebPortal to 3.03.1758 or later.
Harden the application server. Follow the product configuration manual and the server manufacturer's security documentation.
Watch release notes. On-premise operators should track Tasy release notes and install service packs as soon as possible.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Web interface

Contributing

HL7 or FHIR integration Handles patient data User accounts

Tasy EMR

PID-311 Web interface HL7 or FHIR integration Handles patient data

Tasy WebPortal

Web interface

Fix the class in your product

Field input is reflected into a WebView without encoding, so input becomes script in the app context. As the maker, context-encode every value before it renders, set a strict content security policy, and prefer native rendering for sensitive data.

Encode at every sink. Render user data with textContent or an auto-escaping template, never innerHTML.
Set a strict CSP. Block inline and injected script as a second layer.
Prefer native rendering. Keep PHI out of a WebView where a missed encode becomes code.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Universal Viewer	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Aperio GT 450 DX	Leica Biosystems	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novo	PathAI	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aetherSlide	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer

10 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2019-6562 in Philips Tasy EMR?

CVE-2019-6562 is a cross-site scripting flaw (CWE-79, CVSS v3 4.1) in Philips Tasy EMR 3.01.1744 and prior and Tasy WebPortal 3.02.1757 and prior. CISA published it in ICSMA-19-120-01 on April 30, 2019.

Which Tasy EMR and WebPortal versions fix ICSMA-19-120-01?

Philips recommends Tasy EMR 3.03.1745 or higher and Tasy WebPortal 3.03.1758 or higher to fix CVE-2019-6562 and CVE-2019-13557, per CISA advisory ICSMA-19-120-01 from April 30, 2019. Hosted solutions are patched automatically.

← Back to Vulnerabilities

Sources

Philips: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

All coverage and follow: Philips