CVE-2018-19276

Published: Mar 17, 2019

Modified: Aug 5, 2024

PUBLISHED

CVSS v3.0

10.0

CRITICAL

Description

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Attack Complexity

Low

Attack Vector

Network

Availability

High

Confidentiality

High

Integrity

High

Privileges Required

None

Scope

Changed

User Interaction

None

References

http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html

x_refsource_MISC

46327

exploit

x_refsource_EXPLOIT-DB

http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html

x_refsource_MISC

https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization

x_refsource_MISC

https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2018-19276

Description

Affected Products

CVSS v3.0 Details

References