by Kastro
Paper/Archive/CVE-2022-24830

CVE-2022-24830

OpenClinica OpenClinica — Path Traversal in OpenClinica

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.2.882 × 2017.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.16 is vulnerable to path traversal in multiple endpoints, leading to arbitrary file read/write, and potential remote code execution. There are no known workarounds. This issue has been patched and users are recommended to upgrade.

Affected

ProductAffectedFixed inSource
OpenClinica< 3.16–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/OpenClinica/OpenClinica/security/advisories/GHSA-9rrv-prff-qph7refgithub.com/OpenClinica/OpenClinica/commit/6f864e86543f903bd20d6f9fc7056115106441f3