critical9.8Public exploit code
CVE-2018-19276
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- OpenMRS - Java Deserialization RCE (Metasploit)2019-12-18 · remote · linux · Verified
- OpenMRS Platform < 2.24.0 - Insecure Object Deserialization2019-02-05 · webapps · java
Impact
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openmrs | Openmrs | from 1.12.0 before 1.12.1 from 2.0.0 before 2.0.8 from 2.1.0 before 2.1.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html
- http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html
- https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization
- https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607
- https://www.exploit-db.com/exploits/46327/
- http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html
- http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html
- https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization
- https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607
- https://www.exploit-db.com/exploits/46327/