PT-2022-16908 · Unknown · Openclinic Ga

Jlleitschuh · Published 2022-05-13 · Updated 2022-05-24 · CVE-2022-24830

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenClinica versions prior to 3.16

Description OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). It is vulnerable to path traversal in multiple endpoints, leading to arbitrary file read/write, and potential remote code execution. There are no known workarounds.

Recommendations For OpenClinica versions prior to 3.16, upgrade to version 3.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoints to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-24830

GHSA-9RRV-PRFF-QPH7

Affected Products

Openclinic Ga

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24830.json · Exploit
• 🔥 https://github.com/OpenClinica/OpenClinica/security/advisories/GHSA-9rrv-prff-qph7 · Exploit
• https://github.com/OpenClinica/OpenClinica/commit/6f864e86543f903bd20d6f9fc7056115106441f3 · Patch
• https://osv.dev/vulnerability/CVE-2022-24830 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24830 · Security Note
• https://t.me/cibsecurity/42704 · Telegram Post
• https://t.me/cvenotify/30226 · Telegram Post