PT-2012-2996 · Openemr · Openemr

Published 2012-02-07 · Updated 2017-08-29 · CVE-2012-0991

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR version 4.1.0

Description The issue allows remote authenticated users to read arbitrary files due to multiple directory traversal vulnerabilities. This is achieved by including a .. (dot dot) in the formname parameter to various API endpoints, such as "/contrib/acog/print form.php", "/interface/patient file/encounter/load form.php", "/interface/patient file/encounter/view form.php", or "/interface/patient file/encounter/trend form.php".

Recommendations For OpenEMR version 4.1.0, as a temporary workaround, consider restricting access to the formname parameter in the affected API endpoints until a patch is available. Additionally, restrict access to sensitive files and directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2012-0991

Affected Products

Openemr

References · 15

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-02/0004.html · Exploit
• 🔥 https://exploit-db.com/exploits/36650 · Exploit
• 🔥 https://htbridge.ch/advisory/HTB23069 · Exploit
• 🔥 http://securityfocus.com/bid/51788 · Exploit
• 🔥 https://exploit-db.com/exploits/36648 · Exploit
• 🔥 https://exploit-db.com/exploits/36649 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-0991 · Security Note
• http://secunia.com/advisories/47781 · Vendor Advisory
• http://open-emr.org/wiki/index.php/OpenEMR_Patches · Patch
• http://osvdb.org/78727 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0991 · Note
• http://osvdb.org/78729 · Note
• http://osvdb.org/78730 · Note
• http://osvdb.org/78728 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72914 · Note