CSRF in Open-Emr Openemr
CVE-2020-13569
A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce). A specially crafted HTTP request can lead to the execution of arbitrary requests in the context of the victim. An attacker can send an HTTP request to trigger this vulnerability.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.030 (86.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Open-emr Openemr — versions 5.0.2
- N/a Openemr — versions OpenEMR 5.0.2 OpenEMR development version 6.0.0 (commitbabec93f600ff1394f91ccd512bcad85832eb6ce)
Weakness classification (CWE)
Public proof-of-concept exploits
References
- talos-cna@cisco.com (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-13569?
- CVE-2020-13569 is a high-severity vulnerability in Open-Emr Openemr, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2021-01-28.
- How severe is CVE-2020-13569?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2020-13569 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.