CVE-2014-5452: HL7 C-Cda

Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days.

CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations.

Affected products

• HL7 C-Cda: up to and including 1.1

Published 2014-09-02. Last modified 2026-06-17.