CVE-2018-15155
high · 8.8OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/fax/fax_dispatch.php after modifying the "hylafax_enscript" global variable in interface/super/edit_globals.php.
8.8
CVSS
10.2%
EPSS (exploit prob.)
95th
EPSS percentile
2018-08-15
Published
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| open-emr | openemr | < 5.0.1.4 |
Check a specific version with /api/v1/cve/match.
References
- https://github.com/openemr/openemr/pull/1757
- https://insecurity.sh/reports/openemr.pdf
- https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/
- https://www.open-emr.org/wiki/index.php/OpenEMR_Patches
- https://github.com/openemr/openemr/pull/1757
- https://insecurity.sh/reports/openemr.pdf
- https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/
- https://www.open-emr.org/wiki/index.php/OpenEMR_Patches
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2018-15155