What is CVE-2017-12796?

CVE-2017-12796 is a critical-severity vulnerability in Openmrs, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2017-10-23.

How severe is CVE-2017-12796?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Deserialization in Openmrs

CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system commands by crafting malicious XML payloads, as demonstrated by a single admin/reports/reportSchemaXml.form request.

Vulnerability class: Insecure Deserialization

EPSS: 0.042 (90.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Openmrs
N/a — versions n/a

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_MISC, Release Notes, Vendor Advisory)
cve@mitre.org (Exploit, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-12796?: CVE-2017-12796 is a critical-severity vulnerability in Openmrs, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2017-10-23.
How severe is CVE-2017-12796?: Critical severity. CVSS v3 base score is 9.8 out of 10.