CVE-2018-19276 EXPLOIT
9.8
CRITICAL · CVSS 3.1 · EPSS 98.7% (pctl 100)
Patch early
A public exploit exists.
Description
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 98.71% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-502 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2019-03-21 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| openmrs | openmrs |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | OpenMRS - Java Deserialization RCE (Metasploit) | 2019-12-18 |
| exploit-db | OpenMRS Platform < 2.24.0 - Insecure Object Deserialization | 2019-02-05 |
References
- http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html
- http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html
- https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization
- https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607
- https://www.exploit-db.com/exploits/46327/
- http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html
- http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html
- https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization
- https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607
- https://www.exploit-db.com/exploits/46327/
→ the Explorer · watch your stack · NVD