Skip to content
OpenAdvisories
Critical ICSMA-20-184-01 11 CVEs

OpenClinic GA (Update B)

Published Jul 2, 2020 · Updated Jun 15, 2021 · Revision 3

Vendor: OpenClinic GA Product: OpenClinic GA

Summary

Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication, discover restricted information, view/manipulate restricted database information, and/or execute malicious code.

Vulnerabilities 11

  • High 8.8
    CVE-2020-14488

    OpenClinic GA

    OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to upload and execute arbitrary files on the system.

    OpenSource OpenClinic GA
  • High 8.8
    CVE-2020-14490

    OpenClinic GA

    OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensitive files or the execution of malicious uploaded files.

    OpenSource OpenClinic GA
  • High 8.2
    CVE-2016-1182 EPSS 26%

    Improper Input Validation in Apache Struts

    ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE…

    struts:struts org.apache.struts:struts-core Maven
  • High 8.1
    CVE-2016-1181 EPSS 13%

    Improper Input Validation in Apache Struts

    ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a rela…

    struts:struts org.apache.struts:struts-core Maven
  • Medium 6.3
    CVE-2020-14486

    OpenClinic GA

    An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow unauthorized execution of commands.

    OpenSource OpenClinic GA
  • Medium 5.4
    CVE-2020-14492

    OpenClinic GA

    OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution of malicious code within the user’s browser.

    OpenSource OpenClinic GA
  • High —
    CVE-2014-0114 Public exploit EPSS 99%

    Arbitrary code execution in Apache Commons BeanUtils

    Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate…

    commons-beanutils:commons-beanutils commons-beanutils commons-beanutils Debian Ubuntu Maven
  • Unscored —
    CVE-2020-14484

    OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, wh…

  • Unscored —
    CVE-2020-14485

    OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafte…

  • Unscored —
    CVE-2020-14491

    OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may a…

  • Unscored —
    CVE-2020-14494

    OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide…

Revision history

  1. #3

    ICSMA-20-184-01 OpenClinic GA (Update B)

  2. #2

    ICSMA-20-184-01 OpenClinic GA (Update A)

  3. #1

    ICSMA-20-184-01 OpenClinic GA

References