Lucene search

MitreCVE-2023-24610

HistoryFeb 01, 2023 - 2:15 p.m.

CVE-2023-24610

2023-02-0114:15:09

CWE-434

mitre

web.nvd.nist.gov

cve-2023-24610

nosh

remote code execution

authenticated users

php

client-side checks

bypass

protected health information

health charting

upload feature

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

70.5%

JSON

NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the “practice logo” upload feature. The client-side checks can be bypassed. This may allow attackers to steal Protected Health Information because the product is for health charting.

Affected configurations

Nvd

Node

nosh_chartingsystem_projectnosh_chartingsystemMatch2021-03-13

VendorProductVersionCPE
nosh_chartingsystem_projectnosh_chartingsystem2021-03-13cpe:2.3:a:nosh_chartingsystem_project:nosh_chartingsystem:2021-03-13:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nosh_chartingsystem_project	nosh_chartingsystem	2021-03-13	cpe:2.3:a:nosh_chartingsystem_project:nosh_chartingsystem:2021-03-13:::::::*

References

gist.github.com/abbisQQ/d8392acf7e02003e73af973cc9f5f54a

github.com/shihjay2/docker-nosh

github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533

noshemr.wordpress.com

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

70.5%

JSON

Related for CVE-2023-24610