CVE-2012-0991: Path Traversal
Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/printform.php; or (2) loadform.php, (3) viewform.php, or (4) trendform.php in interface/patientfile/encounter.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0991?
CVE-2012-0991 has a moderate severity level as it allows authenticated users to read arbitrary files.
How do I fix CVE-2012-0991?
To fix CVE-2012-0991, upgrade OpenEMR to a version higher than 4.1.0 that addresses these vulnerabilities.
Who is affected by CVE-2012-0991?
CVE-2012-0991 affects users of OpenEMR version 4.1.0 with authenticated access.
What are the implications of CVE-2012-0991?
The implications of CVE-2012-0991 include potential exposure of sensitive files to authenticated users.
What components of OpenEMR are impacted by CVE-2012-0991?
CVE-2012-0991 impacts contrib/acog/print_form.php and multiple files in interface/patient_file/encounter.