CVE-2017-12064: High severity open-emr Openemr vulnerability
Published Aug 1, 2017
·Updated
The csvloghtml function in library/edihistory/edihcsvinc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name.
Affected Software
1 affected component
open-emr Openemr=5.0.0
Remediation
Event History
Aug 1, 2017
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-12064?
CVE-2017-12064 is considered a medium severity vulnerability due to its potential to allow unauthorized access.
2
How do I fix CVE-2017-12064?
To fix CVE-2017-12064, update OpenEMR to version 5.0.1 or later where the vulnerability is addressed.
3
Who is affected by CVE-2017-12064?
CVE-2017-12064 affects users running OpenEMR version 5.0.0 or earlier.
4
What is the attack vector for CVE-2017-12064?
The attack vector for CVE-2017-12064 involves bypassing intended access restrictions by using a crafted name in the csv_log_html function.
5
What component is vulnerable in CVE-2017-12064?
The vulnerable component in CVE-2017-12064 is the csv_log_html function located in library/edihistory/edih_csv_inc.php.