Paper/Archive/CVE-2020-27234

CVE-2020-27234

talos — An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter.

EPSS 0.9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 59.0.590 × 2011.8 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource

OpenClinicOpenClinic GA 5.173.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

talos (CNA)6.4CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

reftalosintelligence.com/vulnerability_reports/TALOS-2020-1207