CVE-2018-19276

CRITICAL 9.8CVE-2018-19276 · Published 21/03/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
openmrs openmrs	`≥ 1.12.0, < 1.12.1≥ 2.0.0, < 2.0.8≥ 2.1.0, < 2.1.4`	`1.12.12.0.82.1.4`

Description

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.

References

packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html · Exploit
packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html · Third Party Advisory
know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization · Third Party Advisory
talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607 · Vendor Advisory
exploit-db.com/exploits/46327 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free