CVEvulnerability
CVE-2017-12796
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-10-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-502
Description
The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system commands by crafting malicious XML payloads, as demonstrated by a single admin/reports/reportSchemaXml.form request.
Affected configurations
• openmrs openmrs (< 2.6.1)
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://isears.github.io/jekyll/update/2017/10/21/openmrs-rce.html Exploit
- https://talk.openmrs.org/t/critical-security-advisory-2017-09-12/13291 Vendor Advisory
- https://wiki.openmrs.org/display/RES/Release+Notes+2.6.1 Release Notes, Vendor Advisory
- https://isears.github.io/jekyll/update/2017/10/21/openmrs-rce.html Exploit
- https://talk.openmrs.org/t/critical-security-advisory-2017-09-12/13291 Vendor Advisory
- https://wiki.openmrs.org/display/RES/Release+Notes+2.6.1 Release Notes, Vendor Advisory