CVE-2017-12064

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/openemr/openemr/commit/b8963a5ca483211ed8de71f18227a0e66a2582adIssue Tracking, Patch, Third Party Advisory
https://github.com/openemr/openemr/commit/b8963a5ca483211ed8de71f18227a0e66a2582adIssue Tracking, Patch, Third Party Advisory

Timeline

Published: Aug 1, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-120659.8spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end pa CVE-2017-120665.4Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrar CVE-2017-120677.5Potrace 1.14 has a heap-based buffer over-read in the interpolate_cubic function in mkbitmap.c.CVE-2017-120686.1The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk ac CVE-2017-120698.2An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.0 CVE-2017-12075.5IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777.CVE-2017-120708.8Unsigned versions of the DLLs distributed by the OPC Foundation may be replaced with malicious code.CVE-2017-120716.5Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote a CVE-2017-120725.4Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated u CVE-2017-120746.5Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authentic CVE-2017-120757.2Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to e CVE-2017-120764.9Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows re