PT-2019-9785 · Openmrs · Openmrs

Nicola Serra · Published 2019-03-17 · Updated 2023-03-03 · CVE-2018-19276

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions OpenMRS versions prior to 2.24.0

Description The issue allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. This is due to an Insecure Object Deserialization vulnerability.

Recommendations For versions prior to 2.24.0, update to version 2.24.0 or later to resolve the issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-19276

Affected Products

Openmrs

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/openmrs_deserialization.rb · Exploit
• 🔥 https://github.com/mpgn/CVE-2018-19276 · Exploit
• 🔥 https://exploit-db.com/exploits/46327 · Exploit
• 🔥 https://exploit-db.com/exploits/47792 · Exploit
• 🔥 http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-19276 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19276 · Security Note
• https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607 · Vendor Advisory
• https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization · Note
• http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html · Note