Lucene search

GitHub_MCVELIST:CVE-2022-24830

HistoryMay 13, 2022 - 11:40 p.m.

CVE-2022-24830 Path Traversal in OpenClinica

2022-05-1323:40:09

CWE-22

GitHub_M

www.cve.org

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

10 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.6%

JSON

OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.16 is vulnerable to path traversal in multiple endpoints, leading to arbitrary file read/write, and potential remote code execution. There are no known workarounds. This issue has been patched and users are recommended to upgrade.

CNA Affected

[
  {
    "product": "OpenClinica",
    "vendor": "OpenClinica",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.16"
      }
    ]
  }
]

References

github.com/OpenClinica/OpenClinica/commit/6f864e86543f903bd20d6f9fc7056115106441f3

github.com/OpenClinica/OpenClinica/security/advisories/GHSA-9rrv-prff-qph7

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

10 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.6%

JSON

Related for CVELIST:CVE-2022-24830