CVE-2018-19276
- State
- Published
- Severity
- 10.0 Critical
- Published
- Mar 17, 2019
- Updated
- Aug 5, 2024
- Reserved
- Nov 14, 2018
Description
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 10.0 Critical | CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N | mitre |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html
- 46327exploit
- http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html
- https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization
- https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.