PT-2023-18807 · Openemr · Openemr

Dennis Brinkrolf · Publicado 2023-02-22 · Atualizado 2023-03-03 · CVE-2023-22973

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 7.0.0

Description A Local File Inclusion (LFI) issue in the interface/forms/LBF/new.php file allows remote authenticated users to execute code via the formname parameter. This can be exploited by authenticated users, potentially leading to code execution.

Recommendations For versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the interface/forms/LBF/new.php file or disabling the formname parameter in the affected API endpoint until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-22973

Produtos afetados

Openemr

Referências · 6

• 🔥 https://sonarsource.com/blog/openemr-remote-code-execution-in-your-healthcare-system · Exploit
• https://open-emr.org/wiki/index.php/OpenEMR_Patches#7.0.0_Patch_.2811.2F30.2F22.29 · Correção
• https://osv.dev/vulnerability/CVE-2023-22973 · Aviso do Fabricante
• https://t.me/cibsecurity/58723 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22973 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-22973 · Nota de Segurança