PT-2022-16127 · Apache · Apache Tomcat

Ibacher

·

Published

2022-02-22

·

Updated

2026-05-04

·

CVE-2022-23612

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions OpenMRS versions prior to 2.1.5 OpenMRS versions prior to 2.2.1 OpenMRS versions prior to 2.3.5 OpenMRS versions prior to 2.4.5 OpenMRS versions prior to 2.5.3
Description The issue affects OpenMRS, a patient-based medical record system, due to a failure to sanitize requests for GET requests to /images and /initfilter/scripts. This allows an attacker to access any file on the system that is accessible to the user ID OpenMRS is running under. The vulnerability can be exploited through arbitrary file exfiltration.
Recommendations For OpenMRS version prior to 2.1.5, update to version 2.1.5. For OpenMRS version prior to 2.2.1, update to version 2.2.1. For OpenMRS version prior to 2.3.5, update to version 2.3.5. For OpenMRS version prior to 2.4.5, update to version 2.4.5. For OpenMRS version prior to 2.5.3, update to version 2.5.3. As a temporary workaround, consider restricting access to the /images and /initfilter/scripts API endpoints until the issue is resolved. Users on older versions of Tomcat should consider upgrading their Tomcat instance to at least version 7.0.28 to mitigate the risk.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-23612
GHSA-8RGR-WW69-JV65

Affected Products

Apache Tomcat