Path traversal in OpenEMR - CVE-2019-14530
Published: August 13, 2019 / Updated: November 25, 2021
Vulnerability identifier: #VU30824
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14530
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote authenticated user to gain access to sensitive information.
An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.
Affected software
OpenEMR
How to mitigate CVE-2019-14530
Install update from vendor's website.
OpenEMR - update to 5.0.2
Links to Public Exploits and PoC-codes
- Exploit #7084 - OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated) (2) (November 25, 2021)
- Exploit #7079 - OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) (2) (November 25, 2021)
- Exploit #6516 - exploit-CVE-2019-14530 (OpenEMR < 5.0.2 - (Authenticated) Path Traversal - Local File Disclosure) (July 4, 2021)
- Exploit #6477 - OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated) (June 28, 2021)