PT-2020-14033 · Openclinic · Openclinic Ga

Published 2020-07-20 · Updated 2020-07-22 · CVE-2020-14485

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClinic GA versions 5.09.02 through 5.89.05b

Description The issue may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality. This could potentially allow execution of admin functions, such as SQL queries.

Recommendations For OpenClinic GA versions 5.09.02 through 5.89.05b, consider restricting access to admin functions and limiting the execution of SQL queries until a fix is available. As a temporary workaround, restrict the use of crafted requests to initiate sessions with limited functionality. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-287

CWE-288

Related Identifiers

CVE-2020-14485

Affected Products

Openclinic Ga

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-14485 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14485 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsma-20-184-01 · Note