PT-2019-9785 · Openmrs · Openmrs

Nicola Serra · Publicado 2019-03-17 · Atualizado 2023-03-03 · CVE-2018-19276

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions OpenMRS versions prior to 2.24.0

Description The issue allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. This is due to an Insecure Object Deserialization vulnerability.

Recommendations For versions prior to 2.24.0, update to version 2.24.0 or later to resolve the issue.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2018-19276

Produtos afetados

Openmrs

Referências · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/openmrs_deserialization.rb · Exploit
• 🔥 https://github.com/mpgn/CVE-2018-19276 · Exploit
• 🔥 https://exploit-db.com/exploits/46327 · Exploit
• 🔥 https://exploit-db.com/exploits/47792 · Exploit
• 🔥 http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html · Exploit
• https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization · Nota
• http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html · Nota
• https://osv.dev/vulnerability/CVE-2018-19276 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19276 · Nota de Segurança
• https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607 · Aviso do Fabricante