CVE-2018-19276

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserializationThird Party Advisory
https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607Vendor Advisory
https://www.exploit-db.com/exploits/46327/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserializationThird Party Advisory
https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607Vendor Advisory
https://www.exploit-db.com/exploits/46327/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-192778.8securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file CVE-2018-192787.5Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash A CVE-2018-192794.3PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second CVE-2018-19285.5IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access th CVE-2018-192806.1Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.CVE-2018-192819.8Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.CVE-2018-192829.8Rockwell Automation PowerFlex 525 AC Drives 5.001 and earlier allow remote attackers to cause a denial of service by crashing the Common Ind CVE-2018-192866.1The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value), and CVE-2018-192876.1XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submiss CVE-2018-192886.1Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.CVE-2018-192896.1An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in CVE-2018-19294.3IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 could allow a malicious user to be allowed to view any view if he knows the URL