PT-2018-12894 · Openemr · Openemr

CVE-2018-15140

·

Publicado

2018-08-13

·

Atualizado

2018-10-10

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4
Description The issue allows a remote attacker authenticated in the patient portal to read arbitrary files. This is achieved via the docid parameter when the mode is set to get in the /portal/import template.php endpoint.
Recommendations For versions prior to 5.0.1.4, update to version 5.0.1.4 or later to resolve the issue.

Exploit

Correção

DoS

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-15140

Produtos afetados

Openemr