CVE-2017-12796

    Dashboard / Vulnerabilities / CVE-2017-12796

    CVE-2017-12796

    Published: 23 Oct 2017Last Modified: 7 Aug 2026

    Summary:

    Details: The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system commands by crafting malicious XML payloads, as demonstrated by a single admin/reports/reportSchemaXml.form request.

    References: https://talk.openmrs.org/t/critical-security-advisory-2017-09-12/13291, https://wiki.openmrs.org/display/RES/Release+Notes+2.6.1, https://isears.github.io/jekyll/update/2017/10/21/openmrs-rce.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0b8ae6299f65159fe7d9b06a6c679834378d31b8

    Affected versions

    2.6.0
    2.6.0-beta

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2017-12796 | CVE-DB