CVE-2020-36243

The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php

published February 7, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.2th percentile for exploit probability.

CVSS
—
EPSS
64%
Percentile
99.2
In the wild
Unconfirmed
What it is

The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. To exploit the vulnerability, an authenticated attacker can send a POST request that executes arbitrary OS commands via shell metacharacters.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.64144 · 99.2th percentile
Published
2021-02-07T19:59Z
EPSS history
Timeline
  • 07 FEB 19:59Z
    The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php
    cvelistv5