#VU31239 Path traversal in OpenEMR - CVE-2018-15140

Vulnerability identifier: #VU31239

Vulnerability risk: Medium

CVSSv4.0: 5.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2018-15140

CWE-ID: CWE-22

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
OpenEMR
Client/Desktop applications / Other client software

Vendor: OpenEMR

Description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to read arbitrary files via the "docid" parameter when the mode is set to get.

Mitigation
Install update from vendor's website.

Vulnerable software versions

OpenEMR: 5.0.1.1 - 5.0.1.3

---

External links
https://github.com/openemr/openemr/pull/1765/files
https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/
https://www.exploit-db.com/exploits/45202/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.