8.8

CVE-2017-9380

Exploit
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Open-emr ≫ Openemr Version <= 5.0.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 15.19% 0.963
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

http://packetstormsecurity.com/files/163087/OpenEMR-5.0.0-Remote-Shell-Upload.html
Third Party Advisory
Exploit
VDB Entry
https://github.com/Hacker5preme/Exploits/tree/main/CVE-2017-9380-Exploit
Third Party Advisory
Exploit
https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-002
Third Party Advisory