CVE-2019-12741: Cross-site Scripting in HAPI FHIR
Summary
CVE-2019-12741: Cross-site Scripting in HAPI FHIR. Affects ca.uhn.hapi.fhir:hapi-fhir-base versions < 3.8.0. Fixed in 3.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The HAPI FHIR library is an open-source Java implementation of the FHIR (Fast Healthcare Interoperability Resources) specification. It provides a set of tools and APIs for building FHIR servers and clients. The HAPI FHIR testpage overlay module is a component used for testing purposes and is not typically used in production systems. It allows developers to interact with FHIR resources and test various functionalities. However, this module is vulnerable to cross-site scripting (XSS) attacks.
Vulnerability Detail
The XSS vulnerability in the HAPI FHIR testpage overlay module arises from unsanitized HTTP parameters being output in a form page. This allows attackers to inject malicious scripts into the page, potentially leading to the leakage of sensitive information such as cookies. The vulnerability exists in the BaseController.java file of the ca/uhn/fhir/to package. Although the attack surface is expected to be low due to the module's limited usage in production systems, affected systems are strongly advised to upgrade to HAPI FHIR version 3.8.0 or later to mitigate the risk.
How To Fix
Latest published version: 8.12.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As this vulnerability primarily affects the HAPI FHIR testpage overlay module, a temporary workaround is to disable or restrict access to this module in production systems. This can be achieved by modifying the server configuration to exclude or limit the availability of the testpage overlay module.
Conclusion
The HAPI FHIR library, specifically the testpage overlay module, is vulnerable to cross-site scripting (XSS) attacks. While the attack surface is expected to be low, it is crucial for affected systems to upgrade to HAPI FHIR version 3.8.0 or later to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ca.uhn.hapi.fhir:hapi-fhir-base →
FAQ
HAPI FHIR is an open-source Java library for implementing the FHIR specification, which enables interoperability of healthcare data.
The HAPI FHIR testpage overlay module is a component of the HAPI FHIR library used for testing purposes, allowing developers to interact with FHIR resources and test functionalities.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the theft of sensitive information or the execution of unauthorized actions.
The XSS vulnerability in HAPI FHIR can be exploited by crafting a specially crafted URL that includes unsanitized HTTP parameters. When a user visits a page with this URL, the malicious script is executed, potentially allowing an attacker to steal sensitive information.
The severity of this vulnerability is classified as MODERATE, with a CVSS score of 6.1.
