8.8
CVE-2018-1000646
- EPSS 3.29%
- Veröffentlicht 20.08.2018 19:31:41
- Zuletzt bearbeitet 21.11.2024 03:40:18
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginLibreHealthIO LH-EHR version REL-2.0.0 contains an Authenticated Unrestricted File Write vulnerability in Import template that can result in write files with malicious content and may lead to remote code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Librehealth ≫ Librehealth Ehr Version2.0.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 3.29% | 0.869 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.5 | 8 | 6.4 |
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
CWE-434 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
https://0dd.zone/2018/08/07/lh-ehr-Authenticated-File-Write/
https://github.com/LibreHealthIO/lh-ehr/issues/1211