CVE-2018-19276

    Dashboard / Vulnerabilities / CVE-2018-19276

    CVE-2018-19276

    Published: 21 Mar 2019Last Modified: 7 Aug 2026

    Summary:

    Details: OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.

    References: http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html, https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization, https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607, http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html, https://www.exploit-db.com/exploits/46327/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8f283ea385d71421d810027c4a6ea70c22c7675b
    Fixed -de2c945a289c1388563fddddfd6de887ecc3b6e7

    Affected versions

    2.0.7
    2.0.6
    2.0.5
    2.0.4.1
    2.0.4
    2.0.3
    2.0.2
    2.0.1
    2.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High