Lucene search

[email protected]CVE-2020-14488

HistoryJul 29, 2020 - 2:15 p.m.

CVE-2020-14488

2020-07-2914:15:00

CWE-434

[email protected]

web.nvd.nist.gov

cve-2020-14488

openclinic

file upload

execution

security vulnerability

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

42.0%

JSON

OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to upload and execute arbitrary files on the system.

CPENameOperatorVersion
freemedsoftware:openclinic_gafreemedsoftware openclinic gaeq5.09.02
freemedsoftware:openclinic_gafreemedsoftware openclinic gaeq5.89.05b

CPE	Name	Operator	Version
freemedsoftware:openclinic_ga	freemedsoftware openclinic ga	eq	5.09.02
freemedsoftware:openclinic_ga	freemedsoftware openclinic ga	eq	5.89.05b

References

us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

42.0%

JSON

Related for CVE-2020-14488

prion1 ics1