CVE-2018-19276

Critical

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute…

mitre·CWE-502·Published 2019-03-17

CVSS

9.8

EPSS

0.99

KEV

Exploits

cve.orgen

214 chars

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.

NVDen

214 chars

NVDes

283 chars

OpenMRS, en versiones anteriores a la 2.24.0, se ha visto afectado por una vulnerabilidad de deserialización insegura de objetos que permite que un usuario no autenticado ejecute comandos arbitrarios en el sistema objetivo mediante datos XML manipulados en el cuerpo de una petición.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	10.0	10.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C
3.0	Primary	cve.org	10.0	—	—	CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
3.0	Primary	cve.org	10.0	—	—	CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
3.0	Secondary	NVD	10.0	3.9	6.0	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
3.1	Primary	NVD	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H