CVE-2019-14530

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter

published August 13, 2019

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.3th percentile for exploit probability.

CVSS
—
EPSS
66%
Percentile
99.3
In the wild
Unconfirmed
What it is

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.65529 · 99.3th percentile
Published
2019-08-13T13:32Z
EPSS history
Timeline
  • 13 AUG 13:32Z
    An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter
    cvelistv5