LabKey Vulnerabilities Threaten Medical Research Data

A trio of vulnerabilities in a popular open source medical data collaboration tool leaves important healthcare research data and potentially subject information open to multiple cross site scripting (XSS) attacks. The flaws are serious as they allow an attacker to retrieve user credentials once a user clicks a malicious link.

Tenable Research on Thursday said that the flaws, which exist in LabKey Server Community Edition 18.2-60106.64, allow a remote unauthenticated attacker to run arbitrary code through their browser, create open redirects to push users to malicious URLs, and map malicious network drives after gaining administrative access.