CVE-2017-12796

{"id": "CVE-2017-12796", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-10-23T04:29:00.210", "references": [{"url": "https://isears.github.io/jekyll/update/2017/10/21/openmrs-rce.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://talk.openmrs.org/t/critical-security-advisory-2017-09-12/13291", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://wiki.openmrs.org/display/RES/Release+Notes+2.6.1", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://isears.github.io/jekyll/update/2017/10/21/openmrs-rce.html", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://talk.openmrs.org/t/critical-security-advisory-2017-09-12/13291", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wiki.openmrs.org/display/RES/Release+Notes+2.6.1", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system commands by crafting malicious XML payloads, as demonstrated by a single admin/reports/reportSchemaXml.form request."}, {"lang": "es", "value": "Reporting Compatibility Add On en versiones anteriores a la 2.0.4 para OpenMRS, tal y como se distribuye en OpenMRS Reference Application en versiones anteriores a la 2.6.1, no autentica usuarios cuando deserializa entradas XML en objetos ReportSchema. El resultado es que usuarios remotos no autenticados pueden ejecutar comandos del sistema operativo manipulando cargas \u00fatiles XML maliciosas, tal y como demuestra una \u00fanica petici\u00f3n admin/reports/reportSchemaXml.form."}], "lastModified": "2024-11-21T03:10:12.657", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC2390B4-BFC2-454E-8A9C-705E364A507D", "versionEndExcluding": "2.6.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}