PT-2020-15587
CVE-2020-23829
·
تاريخ النشر
2020-09-01
·
تاريخ التحديث
2020-09-10
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
LibreHealth EHR version 2.0.0
Description
The issue allows remote attackers to achieve remote code execution (RCE) on the hosting webserver by uploading a maliciously crafted image through the interface/new/new comprehensive save.php file. This is made possible due to an authenticated file upload vulnerability.
Recommendations
For LibreHealth EHR version 2.0.0, consider disabling the file upload functionality in the interface/new/new comprehensive save.php file until a patch is available to prevent remote code execution. Restrict access to this file to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾