Paper/Archive/CVE-2020-27233

CVE-2020-27233

talos — An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter.

EPSS 0.9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 59.0.590 × 2011.8 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource

OpenClinicOpenClinic GA 5.173.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

talos (CNA)6.4CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

reftalosintelligence.com/vulnerability_reports/TALOS-2020-1207