CVE-2018-16795

Опубликовано: 31 дек. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php to upload a .php file.

Ссылки

https://community.open-emr.org/t/openemr-security/10597
Exploit
Vendor Advisory
https://www.open-emr.org/wiki/images/1/11/Openemr_insecurity.pdf
Exploit
Vendor Advisory
https://community.open-emr.org/t/openemr-security/10597
Exploit
Vendor Advisory
https://www.open-emr.org/wiki/images/1/11/Openemr_insecurity.pdf
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:open-emr:openemr:5.0.1.3:*:*:*:*:*:*:*

EPSS

Процентиль: 4%

0.00019

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-427h-c47c-jgj4

github

больше 3 лет назад